CVE-2024-12564CWE-200CWE-276

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ODA CDE inWEB SDK before 2025.3

Medium · published December 12, 2024

CVSS v4.0
6.9
EPSS
1%
Percentile
51.6
In the wild
Unconfirmed
What it is

Exposure of Sensitive Information to an Unauthorized Actor vulnerability was discovered in Open Design Alliance CDE inWEB SDK before 2025.3. Installing CDE Server with default settings allows unauthorized users to visit prometheus metrics page. This can allow attackers to understand more things about the target application which may help in further investigation and exploitation.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
EPSS
0.00674 · 51.6th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-276 · Incorrect Default Permissions
Published
2024-12-12T07:41Z
EPSS history
Timeline
  • 12 DEC 07:41Z
    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ODA CDE inWEB SDK before 2025.3
    cvelistv5