CVE-2024-23329

Summary

CVE-2024-23329 is a vulnerability affecting the changedetection.io open-source website monitoring tool. In certain versions, the API endpoint "/api/v1/watch/<uuid>/history" is accessible to unauthorized users, allowing them to view one's watch history. Although an attacker needs to know the watch UUID, and the endpoint only returns snapshot paths on the server, the potential impact on users' data privacy is still significant. This issue has been patched in version 0.45.13, and it is strongly recommended that users upgrade as soon as possible. At present, there are no known workarounds for this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.