CVE-2024-52297criticalCWE-200

CVE-2024-52297: falha crítica em tolgee-platform

Tolgee's configuration all configuration properties leaked in public configuration DTO

Publicada em

Seguir esta CVE+ Monitorar tolgee-platform

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.8epss 0.6%
Tolgee is an open-source localization platform. Tolgee 3.81.1 included the all configuration properties in the PublicConfiguratioDTO publicly exposed to users. This vulnerability is fixed in v3.81.2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
tolgee · tolgee-platform
CVEs relacionadas — tolgee-platform

No mesmo produto, das mais perigosas para as menos.

CVE-2023-38510HIGHTolgee Lacks Permission Check for API Key for some endpointsEPSS 0.6%CVE-2024-32470MEDIUMTolgee' API keys created by server admin users bypass the permission checkEPSS 0.6%CVE-2023-41316MEDIUMHTML Injection with email in TolgeeEPSS 0.5%CVE-2026-32251CRITICALTolgee has an XXE Injection in Translation ImportEPSS 0.5%CVE-2024-32466LOWTolgee's API key scopes not checked when querying translation dataEPSS 0.4%