« Volver al listado

CVE-2024-29866

Estado: AnalizadaCrítica (9.1)—

Datalust Seq before 2023.4.11151 and 2024 before 2024.1.11146 has Incorrect Access Control because a Project Owner or Organization Owner can escalate to System privileges.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Datalust — SEQ

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-29866",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-29866",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-03-21T18:26:01.602272Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.1,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:datalust:seq:*:*:*:*:*:*:*:*"
          ],
          "vendor": "datalust",
          "product": "seq",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "2023.4.11151",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "2024",
              "lessThan": "2024.1.11146",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-03-21T14:15:07.810",
  "references": [
    {
      "url": "https://datalust.co",
      "tags": [
        "Product"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/datalust/seq-tickets/issues/2127",
      "tags": [
        "Issue Tracking"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://datalust.co",
      "tags": [
        "Product"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/datalust/seq-tickets/issues/2127",
      "tags": [
        "Issue Tracking"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Datalust Seq before 2023.4.11151 and 2024 before 2024.1.11146 has Incorrect Access Control because a Project Owner or Organization Owner can escalate to System privileges."
    },
    {
      "lang": "es",
      "value": "Datalust Seq anterior a 2023.4.11151 y 2024 anterior a 2024.1.11146 tiene un control de acceso incorrecto porque un propietario de proyecto o propietario de una organización puede escalar a privilegios del sistema."
    }
  ],
  "lastModified": "2026-06-17T07:23:15.930",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:datalust:seq:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C6A6B5ED-460C-43C3-9E65-4C84037D02A7",
              "versionEndExcluding": "2023.4.11151"
            },
            {
              "criteria": "cpe:2.3:a:datalust:seq:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D3FED8FB-2EF8-4155-BD69-8A8033CC776F",
              "versionEndExcluding": "2024.1.11146",
              "versionStartIncluding": "2024"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}