CVE-2024-26139CWE-284CWE-657

OpenCTI Authenticated Privilege Escalation

High · published May 23, 2024

CVSS v3.1
8.3
EPSS
0%
Percentile
32.8
In the wild
Unconfirmed
What it is

OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables. Due to lack of certain security controls on the profile edit functionality, an authenticated attacker with low privileges can gain administrative privileges on the web application.

The record
Technical detail
CVSS v3.1
8.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00398 · 32.8th percentile
Weaknesses
CWE-284 · Improper Access Control; CWE-657 · Violation of Secure Design Principles
Published
2024-05-23T11:47Z
EPSS history
Timeline
  • 23 MAY 11:47Z
    OpenCTI Authenticated Privilege Escalation
    cvelistv5