Vulnerability · Published Dec 20, 2024 · Assigned by mitre

CVE-2024-55470

High 7.5

In plain English

A high-severity authentication bypass by spoofing in the oqtane.framework package (NuGet). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.5%top 59.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Oqtane Framework 6.0.0 is vulnerable to Incorrect Access Control. By manipulating the entityid parameter, attackers can bypass passcode validation and successfully log into the application or access restricted data without proper authorization. The lack of server-side validation exacerbates the issue, as the application relies on client-side information for authentication.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
NuGet	oqtane.framework	no fix listed	GHSA-995c-qww8-64fj
NuGet	oqtane.server	no fix listed	GHSA-995c-qww8-64fj

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

Weakness: CWE-290 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

In plain English

Official description

Affected packages & fixed versions

Affected products (as reported)

References