CVE-2024-32470

Опубликовано: 18 апр. 2024

Источник: nvd

CVSS3: 6.5

EPSS Низкий

Описание

Tolgee is an open-source localization platform. When API key created by admin user is used it bypasses the permission check at all. This error was introduced in v3.57.2 and immediately fixed in v3.57.4.

Ссылки

https://github.com/tolgee/tolgee-platform/commit/a0d861028d931f8a54387770eaf3a75031b81234
Patch
https://github.com/tolgee/tolgee-platform/security/advisories/GHSA-pm57-hcm8-38gw
Vendor Advisory
https://github.com/tolgee/tolgee-platform/security/advisories/GHSA-r95p-fqqv-fppc
Not Applicable
https://github.com/tolgee/tolgee-platform/commit/a0d861028d931f8a54387770eaf3a75031b81234
Patch
https://github.com/tolgee/tolgee-platform/security/advisories/GHSA-pm57-hcm8-38gw
Vendor Advisory
https://github.com/tolgee/tolgee-platform/security/advisories/GHSA-r95p-fqqv-fppc
Not Applicable

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:tolgee:tolgee:*:*:*:*:*:*:*:*

Версия от 3.57.2 (включая) до 3.57.4 (исключая)

EPSS

Процентиль: 53%

0.00301

Низкий

6.5 Medium

CVSS3

Дефекты

CWE-863