CVE-2024-29194

CVSS 3.1 Score 8.3 of 10 (high)

Details

Published Mar 24, 2024
Updated: Mar 25, 2024
CWE ID 639

Summary

CVE-2024-29194 is a vulnerability found in OneUptime, a solution for monitoring and managing online services. It arises from improper validation of client-side stored data within the web application. The specific issue is with the "is_master_admin" key stored in the browser's local storage, which can be manipulated by an attacker. By changing this key from false to true, the attacker can gain administrative privileges without server-side validation. The vulnerability has been patched in version 7.0.1815 of OneUptime. This vulnerability has a high base severity rating, with potential impacts on confidentiality and integrity being high as well. The attack vector is through the network, and user interaction is not required. The exploitability score is 2.8 out of 10, indicating a moderate level of difficulty for attackers to exploit this vulnerability.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2024-29194 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options