CVE-2024-50967mediumobserved exploitationCWE-862

CVE-2024-50967

70Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 6.5epss 1.7%

from disclosure to weapon0 days

Published on NVDJan 17

1st PoCJan 16

VulnCheck+161d

exploitation probability

1.7%top 25% of all CVEs

observed exploitation

yesVulnCheck

1 public exploit(s)

The /rest/rights/ REST API endpoint in Becon DATAGerry through 2.2.0 contains an Incorrect Access Control vulnerability. An attacker can remotely access this endpoint without authentication, leading to unauthorized disclosure of sensitive information.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected products

n/a · n/a

public PoCs found — 1

vulncheckvulncheck.com/xdb/ac8717b47b91unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://datagerry.readthedocs.io/en/latest/api/rest/user-management.html#rights https://github.com/0xByteHunter/CVE-2024-50967 https://medium.com/@0xbytehunter/my-first-cve-discovery-of-broken-access-control-in-the-datagerry-platform-7b0404f88a43