CVE-2024-52297 CRITICAL

CVE-2024-52297: Tolgee's configuration all configuration properties leaked in public configuration DTO

Vendor Tolgee

Product tolgee-platform

Weakness CWE-200 · Info exposure

Published November 12, 2024

Last update November 12, 2024

View on NVD All CVEs

CVSS base score

9.8/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Tolgee is an open-source localization platform. Tolgee 3.81.1 included the all configuration properties in the PublicConfiguratioDTO publicly exposed to users. This vulnerability is fixed in v3.81.2.

Key dates

02Disclosure timeline

November 12, 2024 CVE published

November 12, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-52297 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/200.html

Related vulnerabilities

CVE-2024-52297: Tolgee's configuration all configuration properties leaked in public configuration DTO

01Description

02Disclosure timeline

03References

04Related CVE