{"cve":"CVE-2020-5289","nvd":{"published":"2020-03-30T22:15:15.463","modified":"2026-06-17T03:21:12.623","status":"Modified","description":"In Elide before 4.5.14, it is possible for an adversary to \"guess and check\" the value of a model field they do not have access to assuming they can read at least one other field in the model. The adversary can construct filter expressions for an inaccessible field to filter a collection. The presence or absence of models in the returned collection can be used to reconstruct the value of the inaccessible field. Resolved in Elide 4.5.14 and greater.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5},"cwes":["CWE-552","CWE-285"],"references":["https://github.com/yahoo/elide/pull/1236","https://github.com/yahoo/elide/pull/1236/commits/a985f0f9c448aabe70bc904337096399de4576dc","https://github.com/yahoo/elide/security/advisories/GHSA-2mxr-89gf-rc4v","https://github.com/yahoo/elide/pull/1236","https://github.com/yahoo/elide/pull/1236/commits/a985f0f9c448aabe70bc904337096399de4576dc"],"products":["elide:elide"],"source":"nvd","synced_at":"2026-10-19T21:03:08.679916934+00:00"},"epss":{"cve":"CVE-2020-5289","score":0.01251,"percentile":0.69415,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-2mxr-89gf-rc4v","url":"https://osv.dev/vulnerability/GHSA-2mxr-89gf-rc4v","summary":"Read permissions not enforced for client provided filter expressions in Elide.","modified":"2026-07-08T05:59:47.074103473Z","packages":[{"ecosystem":"Maven","name":"com.yahoo.elide:elide-core","purl":"pkg:maven/com.yahoo.elide/elide-core","ranges":["<4.5.14"],"fixed":["4.5.14"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}