CVE-2024-26139 HIGH

CVE-2024-26139: OpenCTI Authenticated Privilege Escalation

Vendor Opencti-Platform
Product opencti
Weakness CWE-284
Published May 23, 2024
Last update August 1, 2024

CVSS base score

8.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

What the vulnerability does

01Description

OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables. Due to lack of certain security controls on the profile edit functionality, an authenticated attacker with low privileges can gain administrative privileges on the web application.

Key dates

02Disclosure timeline

May 23, 2024 CVE published
August 1, 2024 Record updated