CVE-2024-25632

Oct. 1, 2024, 3:15 p.m.

Received
CVE has been recently published to the CVE List and has been received by the NVD.

Products

eLabFTW

  • >=5.0.0, <5.1.0

Source

security-advisories@github.com

Tags

CVE-2024-25632 details

Published : Oct. 1, 2024, 3:15 p.m.
Last Modified : Oct. 1, 2024, 3:15 p.m.

Description

eLabFTW is an open source electronic lab notebook for research labs. In the context of eLabFTW, an administrator is a user account with certain privileges to manage users and content in their assigned team/teams. A user may be an administrator in one team and a regular user in another. The vulnerability allows a regular user to become administrator of a team where they are a member, under a reasonable configuration. Additionally, in eLabFTW versions subsequent to v5.0.0, the vulnerability may allow an initially unauthenticated user to gain administrative privileges over an arbitrary team. The vulnerability does not affect system administrator status. Users should upgrade to version 5.1.0. System administrators are advised to turn off local user registration, saml_team_create and not allow administrators to import users into teams, unless strictly required.

CVSS Score

1 2 3 4 5 6 7 8.6 9 10

Weakness

Weakness Name Description
CWE-266 Incorrect Privilege Assignment A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

CVSS Data

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

Base Score

8.6

Exploitability Score

3.9

Impact Score

4.7

Base Severity

HIGH

References

URL Source
https://github.com/elabftw/elabftw/security/advisories/GHSA-6m7p-gh9f-5mgg security-advisories@github.com
This website uses the NVD API, but is not approved or certified by it.