CVE-2024-46097
CVSS 3.1 Score 8.1 of 10 (high)
Details
Published Sep 27, 2024
Updated: Sep 30, 2024
CWE ID 284
Summary
CVE-2024-46097 is a vulnerability affecting TestLink 1.9.20. This issue involves incorrect access control in the TestPlan editing section. When a new TestPlan is created, an automatically generated ID is used. By manipulating the tplan_id parameter during the edit function, users can gain unauthorized access to other TestPlans, including administrative ones. This vulnerability allows for ID recovery and modification, posing a significant risk to the security and integrity of TestPlans.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- TestLink