VulnerabilityDeferred

CVE-2024-52528

Budget Control Gateway does not properly validate auth tokens, which allows attackers to bypass intended restrictions.

CRITICAL 9.3EPSS 0.57%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.57%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Budget Control Gateway acts as an entry point for incoming requests and routes them to the appropriate microservices for Budget Control. Budget Control Gateway does not properly validate auth tokens, which allows attackers to bypass intended restrictions. This vulnerability is fixed in 1.5.2.

CVSS 4.0: 9.3 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.57% probability · 46th percentile
CISA KEV: Not listed
Weakness: CWE-285
Source: security-advisories@github.com

References

https://github.com/BudgetControl/Gateway/security/advisories/GHSA-jqx6-gm7f-vp7m

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.