CVE-2024-45805

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

OpenCTI is an open-source cyber threat intelligence platform. Before 6.3.0, general users can access information that can only be accessed by users with access privileges to admin and support information (SETTINGS_SUPPORT). This is due to inadequate access control for support information (http://<opencti_domain>/storage/get/support/UUID/UUID.zip), and that the UUID is available to general users using an attached query (logs query). This vulnerability is fixed in 6.3.0.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200 CWE-285

Affected software

No affected versions have been published.

Timeline

Published: Dec 26, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-458066.5Envoy is a cloud-native high-performance edge/middle/service proxy. A security vulnerability in Envoy allows external clients to manipulate CVE-2024-458077.5Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's 1.31 is using `oghttp` as the default HTTP/2 codec, and there ar CVE-2024-458086.5Envoy is a cloud-native high-performance edge/middle/service proxy. A vulnerability has been identified in Envoy that allows malicious attac CVE-2024-458097.5Envoy is a cloud-native high-performance edge/middle/service proxy. Jwt filter will lead to an Envoy crash when clear route cache with remot CVE-2024-45815.4The Slider Revolution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Add Layer widget in all versions up CVE-2024-458107.5Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy will crash when the http async client is handling `sendLocalReply`CVE-2024-458114.8Vite a frontend build tooling framework for javascript. In affected versions the contents of arbitrary files can be returned to the browser.CVE-2024-458126.4Vite a frontend build tooling framework for javascript. Affected versions of vite were discovered to contain a DOM Clobbering vulnerability CVE-2024-458135.3find-my-way is a fast, open source HTTP router, internally using a Radix Tree (aka compact Prefix Tree), supports route params, wildcards, a CVE-2024-458156.5Backstage is an open framework for building developer portals. A malicious actor with authenticated access to a Backstage instance with the CVE-2024-458166.5Backstage is an open framework for building developer portals. When using the AWS S3 or GCS storage provider for TechDocs it is possible to CVE-2024-458177.3In x86's APIC (Advanced Programmable Interrupt Controller) architecture, error conditions are reported in a status register. Furthermore, t