CVE-2024-2292 Access Control Vulnerabilities lead to Violation of Privacy and Modification of Personal Data
Unauthorized users can view and modify other users' personal data due to missing access controls in ChangeWeb UnifiedTransform.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-2292?
CVE-2024-2292 is a high-severity missing authorization vulnerability in changeweb/unifiedtransform, published on 20 Mar 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Due to a lack of access control, unauthorized users are able to view and modify information pertaining to other users.
Weakness: CWE-862
Which versions are affected by CVE-2024-2292?
How do I fix CVE-2024-2292?
No fix has been published for CVE-2024-2292 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-2292 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-2292 exists.
Sources
Also known as GHSA-xv4c-2443-pc28.