CVE-2025-24977

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

OpenCTI is an open cyber threat intelligence (CTI) platform. Prior to version 6.4.11 any user with the capability `manage customizations` can execute commands on the underlying infrastructure where OpenCTI is hosted and can access internal server side secrets by misusing the web-hooks. Since the malicious user gets a root shell inside a container this opens up the the infrastructure environment for further attacks and exposures. Version 6.4.11 fixes the issue.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
OpenCTI-Platform	opencti	< 6.4.11

References

https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-mf88-g2wq-p7qmVendor Advisory

Timeline

Published: May 5, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-24984.3An improper access control in Gitlab EE affecting all versions from 12.0 prior to 18.0.6, 18.1 prior to 18.1.4, and 18.2 prior to 18.2.2 tha CVE-2025-249805.3pimcore/admin-ui-classic-bundle provides a Backend UI for Pimcore. In affected versions an error message discloses existing accounts and lea CVE-2025-249819.3MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. In affected versions unsafe parsing logi CVE-2025-249824.3Cross-site request forgery vulnerability exists in Activity Log WinterLock versions prior to 1.2.5. If a user views a malicious page while l CVE-2025-249837.0Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.CVE-2025-249844.6Insertion of sensitive information into log file in Windows NTFS allows an unauthorized attacker to disclose information with a physical att CVE-2025-249857.8Integer overflow or wraparound in Windows Fast FAT Driver allows an unauthorized attacker to execute code locally.CVE-2025-249866.5Improper isolation or compartmentalization in Azure PromptFlow allows an unauthorized attacker to execute code over a network.CVE-2025-249876.8Out-of-bounds read in Windows USB Video Driver allows an authorized attacker to elevate privileges with a physical attack.CVE-2025-249886.8Out-of-bounds read in Windows USB Video Driver allows an authorized attacker to elevate privileges with a physical attack.CVE-2025-249899.8An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a network potentially byp CVE-2025-24995.4Client side access control bypass in the permission component in Devolutions Remote Desktop Manager on Windows. An authenticated user can e