CVE-2024-46097 Missing authorization in n/a
Attackers with minimal privileges can modify or view any TestPlan by manipulating the ID parameter due to missing permission checks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-46097?
CVE-2024-46097 is a high-severity missing authorization vulnerability in n/a, published on 27 Sep 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
TestLink 1.9.20 is vulnerable to Incorrect Access Control in the TestPlan editing section. When a new TestPlan is created, an ID with an incremental value is automatically generated. Using the edit function you can change the tplan_id parameter to another ID. The application does not carry out a check on the user's permissions maing it possible to recover the IDs of all the TestPlans (even the administrative ones) and modify them even with minimal privileges.
Weakness: CWE-284
Which versions are affected by CVE-2024-46097?
It affects 1 product.
Products include Testlink Testlink.
How do I fix CVE-2024-46097?
No fix has been published for CVE-2024-46097 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-46097 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-46097 exists.
Other vulnerabilities in n/a
Sources
Also known as GHSA-wwq9-rfhf-r6h9.