CVE-2024-27790 Missing authorization in FileMaker Server

High 7.5 Published 26 Apr 2024 Updated 2 Aug 2024

Attackers can access unauthorized database records in FileMaker Server due to missing transaction validation, requiring an upgrade to secure data.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-27790?

CVE-2024-27790 is a high-severity missing authorization vulnerability in Claris FileMaker Server, published on 26 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Claris International has resolved an issue of potentially allowing unauthorized access to records stored in databases hosted on FileMaker Server. This issue has been fixed in FileMaker Server 20.3.2 by validating transactions before replying to client requests.

Weakness: CWE-284

Which versions are affected by CVE-2024-27790?

It affects 1 product.

Products include Claris Filemaker Server.

How do I fix CVE-2024-27790?

No fix has been published for CVE-2024-27790 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-27790 being exploited?

There is no known exploitation of CVE-2024-27790 in the wild and no public exploit code.

Sources

Also known as GHSA-rcf6-gj9x-5p73.