CVE-2024-45805: OpenCTI is an open-source cyber threat intelligence platform. Before 6.3.0, general users can access information that can only be accessed by users with access…

PriorityP422medium4.3CVSS 3.1

AVNACLPRLUINSUCLINAN

EPSS

0.35%

26.6th percentile

OpenCTI is an open-source cyber threat intelligence platform. Before 6.3.0, general users can access information that can only be accessed by users with access privileges to admin and support information (SETTINGS_SUPPORT). This is due to inadequate access control for support information (http:///storage/get/support/UUID/UUID.zip), and that the UUID is available to general users using an attached query (logs query). This vulnerability is fixed in 6.3.0.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
citeum	opencti	< 6.3.0	6.3.0
opencti-platform	opencti	< 6.3.0	6.3.0

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.