CVE-2024-32466: falha de baixa gravidade em tolgee-platform
Tolgee's API key scopes not checked when querying translation data
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
8Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 2.7epss 0.4%
Tolgee is an open-source localization platform. For the `/v2/projects/translations` and `/v2/projects/{projectId}/translations` endpoints, translation data was returned even when API key was missing `translation.view` scope. However, it was impossible to fetch the data when user was missing this scope. So this is only relevant for API keys generated by users permitted to `translation.view`. This vulnerability is fixed in v3.57.2
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
tolgee · tolgee-platformCVEs relacionadas — tolgee-platform
No mesmo produto, das mais perigosas para as menos.
CVE-2023-38510HIGHTolgee Lacks Permission Check for API Key for some endpointsEPSS 0.6%CVE-2024-52297CRITICALTolgee's configuration all configuration properties leaked in public configuration DTOEPSS 0.6%CVE-2024-32470MEDIUMTolgee' API keys created by server admin users bypass the permission checkEPSS 0.6%CVE-2023-41316MEDIUMHTML Injection with email in TolgeeEPSS 0.5%CVE-2026-32251CRITICALTolgee has an XXE Injection in Translation ImportEPSS 0.5%