CVE-2024-46897 Missing authorization in Exment
A logged-in user with table management permissions can access or modify unauthorized table data due to incorrect permission assignments.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-46897?
CVE-2024-46897 is a low-severity missing authorization vulnerability in Kajitori Co.,Ltd Exment, published on 18 Oct 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Incorrect permission assignment for critical resource issue exists in Exment v6.1.4 and earlier and Exment v5.0.11 and earlier. A logged-in user with the permission of table management may obtain and/or alter the information of the unauthorized table.
Weakness: CWE-732
Which versions are affected by CVE-2024-46897?
It affects 1 product.
Products include Exceedone Exment.
How do I fix CVE-2024-46897?
No fix has been published for CVE-2024-46897 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-46897 being exploited?
There is no known exploitation of CVE-2024-46897 in the wild and no public exploit code.
Other vulnerabilities in Kajitori Co.,Ltd Exment
- CVE-2022-37333 exceedone/exment and exceedone/laravel-admin SQL Injection vulnerability
- CVE-2024-47793 Cross-site scripting in Exment
- CVE-2022-38080 exceedone/exment and exceedone/laravel-admin Cross-site Scripting vulnerability
- CVE-2022-38089 Cross-site scripting in Exment
- CVE-2020-5619 Cross-site scripting in Exment
Sources
Also known as GHSA-c983-r7vq-6347.