CVE-2024-32470mediumCWE-863

CVE-2024-32470: falha de média gravidade em tolgee-platform

Tolgee' API keys created by server admin users bypass the permission check

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar tolgee-platform

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.5epss 0.6%
Tolgee is an open-source localization platform. When API key created by admin user is used it bypasses the permission check at all. This error was introduced in v3.57.2 and immediately fixed in v3.57.4.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
tolgee · tolgee-platform
CVEs relacionadas — tolgee-platform

No mesmo produto, das mais perigosas para as menos.

CVE-2023-38510HIGHTolgee Lacks Permission Check for API Key for some endpointsEPSS 0.6%CVE-2024-52297CRITICALTolgee's configuration all configuration properties leaked in public configuration DTOEPSS 0.6%CVE-2023-41316MEDIUMHTML Injection with email in TolgeeEPSS 0.5%CVE-2026-32251CRITICALTolgee has an XXE Injection in Translation ImportEPSS 0.5%CVE-2024-32466LOWTolgee's API key scopes not checked when querying translation dataEPSS 0.4%