VulnerabilityDeferred

CVE-2024-55470

Oqtane Framework 6.0.0 is vulnerable to Incorrect Access Control.

HIGH 7.5EPSS 0.46%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.46%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Oqtane Framework 6.0.0 is vulnerable to Incorrect Access Control. By manipulating the entityid parameter, attackers can bypass passcode validation and successfully log into the application or access restricted data without proper authorization. The lack of server-side validation exacerbates the issue, as the application relies on client-side information for authentication.

CVSS 3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.46% probability · 38th percentile
CISA KEV: Not listed
Weakness: CWE-290
Source: cve@mitre.org

References

https://gist.github.com/Kaushikjoshi/2d8ad350ba5e72030fcee2536498cfe4
https://github.com/oqtane/oqtane.framework/pull/4878/files

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.