CVE-2024-24830

CVSS 3.1 Score 8.8 of 10 (high)

Details

Published Feb 8, 2024
Updated: Feb 15, 2024
CWE ID 272
CWE ID 285
CWE ID 284
CWE ID 269
CWE ID 287

Summary

CVE-2024-24830 is a newly discovered vulnerability in OpenObserve's observability platform, affecting its "/api/{org_id}/users" endpoint. The issue enables authenticated regular users, or 'members,' to bypass intended security controls and add new users with elevated privileges, including the 'root' role. This vulnerability, which resides in the user creation process, occurs due to insufficient validation of user roles in the payload. An unauthorized privilege escalation results, posing a significant risk to data security by granting unauthorized access to application resources. All users, especially those in administrative roles, are impacted. This issue has been rectified in release version 0.8.0, and users are advised to upgrade as soon as possible. There are currently no known workarounds for this vulnerability.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share