CVE-2024-29194highCWE-639

CVE-2024-29194: fallo de gravedad alta en oneuptime

OneUptime Vulnerable to a Privilege Escalation via Local Storage Key Manipulation

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear oneuptime+ Monitorear @oneuptime/common-server

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.3epss 0.7%
OneUptime is a solution for monitoring and managing online services. The vulnerability lies in the improper validation of client-side stored data within the web application. Specifically, the is_master_admin key, stored in the local storage of the browser, can be manipulated by an attacker. By changing this key from false to true, the application grants administrative privileges to the user, without proper server-side validation. This has been patched in 7.0.1815.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Productos afectados
OneUptime · oneuptime
CVEs relacionadas — oneuptime

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-27728CRITICALOneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec()EPSS 2.0%CVE-2026-30957CRITICALOneUptime Synthetic Monitor RCE via exposed Playwright browser objectEPSS 1.3%CVE-2026-30958HIGHOneUptime: Path Traversal — Arbitrary File Read (No Auth)EPSS 1.2%CVE-2026-33396CRITICALOneUptime has sandbox escape in Synthetic Monitor Playwright runtime allows project members to execute arbitrary commands on ProbeEPSS 0.8%CVE-2026-32306CRITICALOneUptime ClickHouse SQL Injection via Aggregate Query ParametersEPSS 0.7%CVE-2026-34759CRITICALOneUptime: Unauthenticated notification API endpoints - financial abuse via phone number purchase, service disruption, and SMTP credential exposureEPSS 0.6%