CVE-2024-42463 Leak of organizations messages

What is CVE-2024-42463?

CVE-2024-42463 is a high-severity missing authorization vulnerability in upKeeper Manager, published on 16 Aug 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Authorization Bypass Through User-Controlled Key vulnerability in upKeeper Solutions product upKeeper Manager allows Utilizing REST's Trust in the System Resource to Obtain Sensitive Data.This issue affects upKeeper Manager: through 5.1.9.

Weakness: CWE-639

Which versions are affected by CVE-2024-42463?

It affects 1 product.

Products include Upkeeper Upkeeper Manager.

How do I fix CVE-2024-42463?

No fix has been published for CVE-2024-42463 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-42463 being exploited?

There is no known exploitation of CVE-2024-42463 in the wild and no public exploit code.

Other vulnerabilities in upKeeper Manager

• CVE-2024-42462 Bypass multifactor authentication Critical 10.0
• CVE-2024-42466 Lack of resources and rate limiting - login Critical 9.5
• CVE-2024-42465 Lack of resources and rate limiting - two factor authentication Critical 9.0
• CVE-2025-8663 Information disclosure in upKeeper Manager High 8.8
• CVE-2024-42464 Leak of user information High 7.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-fhxh-jfcp-fmv9.