sbomify Insights

Search by CVE or GitHub advisory id, package name or title.

CVE-2024-45408 eLabFTW contains a direct and indirect information disclosure

High 7.5 Published Updated

Authenticated users can access restricted information due to incorrect permission checks, exposing sensitive data in eLabFTW.

Exploited in the wild
Not known
Login needed
Not needed
Attackable
Over the internet
Victim action needed
Not needed
Fix
None listed

What is CVE-2024-45408?

CVE-2024-45408 is a high-severity missing authorization vulnerability in elabftw, published on 1 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

eLabFTW is an open source electronic lab notebook for research labs. An incorrect permission check has been found that could allow an authenticated user to access several kinds of otherwise restricted information. If anonymous access is allowed (something disabled by default), this extends to anyone. Users are advised to upgrade to at least version 5.1.0. System administrators can disable anonymous access in the System configuration panel.

Weakness: CWE-284

Which versions are affected by CVE-2024-45408?

It affects 1 product.

Products include Elabftw Elabftw.

How do I fix CVE-2024-45408?

No fix has been published for CVE-2024-45408 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-45408 being exploited?

There is no known exploitation of CVE-2024-45408 in the wild and no public exploit code.

Sources

Also known as GHSA-2c83-6j74-w8r5.

Is CVE-2024-45408 in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free