Medium severity6.8NVD Advisory· Published Mar 30, 2020· Updated Jun 17, 2026
CVE-2020-5289
CVE-2020-5289
Description
In Elide before 4.5.14, it is possible for an adversary to "guess and check" the value of a model field they do not have access to assuming they can read at least one other field in the model. The adversary can construct filter expressions for an inaccessible field to filter a collection. The presence or absence of models in the returned collection can be used to reconstruct the value of the inaccessible field. Resolved in Elide 4.5.14 and greater.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
com.yahoo.elide:elide-coreMaven | < 4.5.14 | 4.5.14 |
Affected products
3Patches
Vulnerability mechanics
References
5- github.com/yahoo/elide/pull/1236nvdPatchThird Party AdvisoryWEB
- github.com/yahoo/elide/pull/1236/commits/a985f0f9c448aabe70bc904337096399de4576dcnvdPatchWEB
- github.com/advisories/GHSA-2mxr-89gf-rc4vghsaADVISORY
- github.com/yahoo/elide/security/advisories/GHSA-2mxr-89gf-rc4vnvdThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2020-5289ghsaADVISORY
News mentions
0No linked articles in our index yet.