CVE-2024-36535 Missing authorization in n/a

What is CVE-2024-36535?

CVE-2024-36535 is a critical missing authorization vulnerability in n/a, published on 24 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Insecure permissions in meshery v0.7.51 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.

Weakness: CWE-284

Which versions are affected by CVE-2024-36535?

It affects 1 product.

Products include Layer5 Meshery.

How do I fix CVE-2024-36535?

No fix has been published for CVE-2024-36535 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-36535 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-36535 exists.

Other vulnerabilities in n/a

• CVE-2023-46575 SQL injection vulnerability in Meshery Critical 9.8
• CVE-2021-31856 SQL injection in n/a Critical 9.8
• CVE-2024-29031 Meshery SQL Injection vulnerability High 7.5
• CVE-2024-35181 GHSL-2024-013 Meshery SQL Injection vulnerability Medium 5.9
• CVE-2024-35182 GHSL-2024-014 Meshery SQL Injection vulnerability Medium 5.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-fv8v-82f6-g6f6.