Back

CVE-2024-34519

May 5, 2024, 10:15 p.m.

Received
CVE has been recently published to the CVE List and has been received by the NVD.

Products

Avantra Server

  • 24.0.0 - 24.0.6
  • 24.1.0

Source

cve@mitre.org

Tags

cve@mitre.org
2024-05-05
CVE-2024-34519

CVE-2024-34519 details

Published : May 5, 2024, 10:15 p.m.
Last Modified : May 5, 2024, 10:15 p.m.

Description

Avantra Server 24.x before 24.0.7 and 24.1.x before 24.1.1 mishandles the security of dashboards, aka XAN-5367. If a user can create a dashboard with an auto-login user, data disclosure may occur. Access control can be bypassed when there is a shared dashboard, and its auto-login user has privileges that a dashboard visitor should not have.

CVSS Score

1 2 3 4 5 6 7 8 9 10

Weakness

Weakness Name Description

References

URL Source
https://docs.avantra.com/release-notes/24/changes.html cve@mitre.org
https://support.avantra.com/support/solutions/articles/44002516766-xan-5367-security-vulnerability-fix-for-dashboards cve@mitre.org
This website uses the NVD API, but is not approved or certified by it.