8.8
CVE-2024-47210
- EPSS 0.58%
- Veröffentlicht 21.09.2024 23:15:14
- Zuletzt bearbeitet 15.04.2026 00:35:42
- CVE-Watchlists
- Unerledigt
Gladys Assistant before 4.45.1 allows Privilege Escalation (a user changing their own role) because req.body.role can be used in updateMySelf in server/api/controllers/user.controller.js.
Daten sind bereitgestellt durch das CVE Programm von Authorized Data Publishers (ADP) (Unstrukturiert)
Herstellergladysassistant
≫
Produkt
gladys_assistant
Default Statusunknown
Version
0
Version <
4.45.1
Status
affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.58% | 0.431 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| CISA-ADP | 8.8 | 2.8 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
|
CWE-400 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource.
https://github.com/GladysAssistant/Gladys/commit/344ad9b8ca3078d9292dd95f2dd7b9172bc6ebbe
https://github.com/GladysAssistant/Gladys/compare/v4.45.0...v4.45.1
https://github.com/GladysAssistant/Gladys/pull/2115