CVE-2024-28087 Bonitasoft Runtime Community edition's contains an insecure direct object references vulnerability
Attackers can access or modify unauthorized data due to missing dynamic permissions in the Bonitasoft runtime Community edition.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-28087?
CVE-2024-28087 is a medium-severity missing authorization vulnerability in n/a, published on 15 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Bonitasoft runtime Community edition, the lack of dynamic permissions causes IDOR vulnerability. Dynamic permissions existed only in Subscription edition and have now been restored in Community edition, where they are not custmizable.
Weakness: CWE-284
Which versions are affected by CVE-2024-28087?
2 open source packages ship an affected version, including org.bonitasoft.engine:bonita-server.
| Package | Affected | Fixed in |
|---|---|---|
org.bonitasoft.engine:bonita-server Maven | All versions | 10.1.0.W11 |
org.bonitasoft.engine:bonita-server Maven | All versions | 10.1.0.W11 |
How do I fix CVE-2024-28087?
Upgrade org.bonitasoft.engine:bonita-server to 10.1.0.W11 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-28087 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-28087 exists.
Sources
Also known as GHSA-76v2-48w6-crxr.