CVE-2024-23329

LowCVSS 3.7/10Last modified Jun 17, 2026

Description

changedetection.io is an open source tool designed to monitor websites for content changes. In affected versions the API endpoint `/api/v1/watch/<uuid>/history` can be accessed by any unauthorized user. As a result any unauthorized user can check one's watch history. However, because unauthorized party first needs to know a watch UUID, and the watch history endpoint itself returns only paths to the snapshot on the server, an impact on users' data privacy is minimal. This issue has been addressed in version 0.45.13. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Jan 19, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-23337.2A vulnerability classified as critical has been found in CodeAstro Membership Management System 1.0. Affected is an unknown function of the CVE-2024-233305.3Tuta is an encrypted email service. In versions prior to 119.10, an attacker can attach an image in a html mail which is loaded from externa CVE-2024-233317.5Vite is a frontend tooling framework for javascript. The Vite dev server option `server.fs.deny` can be bypassed on case-insensitive file sy CVE-2024-233326.8The Notary Project is a set of specifications and tools intended to provide a cross-industry standard for securing software supply chains by CVE-2024-233336.6LDAP Account Manager (LAM) is a webfrontend for managing entries stored in an LDAP directory. LAM's log configuration allows to specify arbi CVE-2024-233347.5aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static ro CVE-2024-233354.7MyBB is a free and open source forum software. The backup management module of the Admin CP may accept `.htaccess` as the name of the backup CVE-2024-233365.0MyBB is a free and open source forum software. The default list of disallowed remote hosts does not contain the `127.0.0.0/8` block, which m CVE-2024-233376.5jq is a command-line JSON processor. In versions up to and including 1.7.1, an integer overflow arises when assigning value using an index o CVE-2024-233396.5hoolock is a suite of lightweight utilities designed to maintain a small footprint when bundled. Starting in version 2.0.0 and prior to vers CVE-2024-23346.4The Template Kit – Import plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the template upload functionality in all ver CVE-2024-233405.3@hono/node-server is an adapter that allows users to run Hono applications on Node.js. Since v1.3.0, @hono/node-server has used its own Requ