CVE-2024-32470

April 18, 2024, 6:25 p.m.

6.5
Medium

Description

Tolgee is an open-source localization platform. When API key created by admin user is used it bypasses the permission check at all. This error was introduced in v3.57.2 and immediately fixed in v3.57.4.

Product(s) Impacted

Product Versions
Tolgee
  • ['3.57.2', '3.57.3']

Weaknesses

Common security weaknesses mapped to this vulnerability.

References

https://github.com/tolgee/tolgee-platform/commit/a0d861028d931f8a54387770eaf3a75031b81234
https://github.com/tolgee/tolgee-platform/security/advisories/GHSA-pm57-hcm8-38gw
https://github.com/tolgee/tolgee-platform/security/advisories/GHSA-r95p-fqqv-fppc

Tags

CVSS Score

6.5 / 10

CVSS Data - 3.1

  • Attack Vector: NETWORK
  • Attack Complexity: LOW
  • Privileges Required: HIGH
  • Scope: UNCHANGED
  • Confidentiality Impact: HIGH
  • Integrity Impact: HIGH
  • Availability Impact: NONE

    • CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

    View Vector String

Timeline

Published: April 18, 2024, 3:15 p.m.
Last Modified: April 18, 2024, 6:25 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

security-advisories@github.com

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.