CVE-2024-29194

HighCVSS 8.3/10Last modified Jun 17, 2026

Description

OneUptime is a solution for monitoring and managing online services. The vulnerability lies in the improper validation of client-side stored data within the web application. Specifically, the is_master_admin key, stored in the local storage of the browser, can be manipulated by an attacker. By changing this key from false to true, the application grants administrative privileges to the user, without proper server-side validation. This has been patched in 7.0.1815.

Metrics

CVSS 3.1 8.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Mar 24, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-291958.1The azure-c-shared-utility is a C library for AMQP/MQTT communication to Azure Cloud Services. This library may be used by the Azure IoT C S CVE-2024-291962.7phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. There is a Path Traversal vulnerabili CVE-2024-291976.5Pimcore is an Open Source Data & Experience Management Platform. Any call with the query argument `?pimcore_preview=true` allows to view unp CVE-2024-291988.2GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. It possible to achieve Serv CVE-2024-291995.3Nautobot is a Network Source of Truth and Network Automation Platform. A number of Nautobot URL endpoints were found to be improperly access CVE-2024-29205.3The WP-Members Membership Plugin plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.4.9.3 du CVE-2024-292006.5Kimai is a web-based multi-user time-tracking application. The permission `view_other_timesheet` performs differently for the Kimai UI and t CVE-2024-292019.9JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can bypass the input validation CVE-2024-292029.9JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can exploit a Jinja2 template in CVE-2024-292036.1TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content insertion code. CVE-2024-292049.8A Heap Overflow vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows a remote unauthenticated attacker to e CVE-2024-292057.5An Improper Check for Unusual or Exceptional Conditions vulnerability in the web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti P