Vulnerability · Published Apr 3, 2024 · Assigned by VulDB

CVE-2024-3270ThingsBoard AdvancedFeature access control

Low 3.8

In plain English

A low-severity improper access control in ThingsBoard. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).

Severity (CVSS 3.1)3.8Low

Exploit odds (30 days)0.6%top 52.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability classified as problematic was found in ThingsBoard up to 3.6.2. This vulnerability affects unknown code of the component AdvancedFeature. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-259282 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure and replied to be planning to fix this issue in version 3.7.

Affected products (as reported)

Vendor	Product	Versions
n/a	ThingsBoard	3.6.03.6.13.6.2

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L

References

VDB-259282 | ThingsBoard AdvancedFeature access control vdb-entry
VDB-259282 | CTI Indicators (IOB, IOC, TTP) signature, permissions-required
Submit #301359 | Thingsboard Thingsboard 3.6.2 Arbitrary File Write third-party-advisory
https://drive.google.com/file/d/1w9iSMpyKDuapH9wjsgTe8AYPn8Z30u2Z/view?usp=drive_link exploit