Vulnerability · Published Apr 18, 2024 · Assigned by GitHub_M
CVE-2024-32470Tolgee' API keys created by server admin users bypass the permission check
Medium 6.5
In plain English
A medium-severity incorrect authorization in tolgee-platform from tolgee. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.6%top 53.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Tolgee is an open-source localization platform. When API key created by admin user is used it bypasses the permission check at all. This error was introduced in v3.57.2 and immediately fixed in v3.57.4.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| tolgee | tolgee-platform | >= 3.57.2, < 3.57.4 |
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
References
- https://github.com/tolgee/tolgee-platform/security/advisories/GHSA-pm57-hcm8-38gw x_refsource_CONFIRM
- https://github.com/tolgee/tolgee-platform/security/advisories/GHSA-r95p-fqqv-fppc x_refsource_MISC
- https://github.com/tolgee/tolgee-platform/commit/a0d861028d931f8a54387770eaf3a75031b81234 x_refsource_MISC