« Volver al listado

CVE-2024-55186

Estado: AplazadaMedia (4.3)—

An IDOR (Insecure Direct Object Reference) vulnerability exists in oqtane Framework 6.0.0, allowing a logged-in user to access inbox messages of other users by manipulating the notification ID in the request URL. By changing the notification ID, an attacker can view sensitive mail details belonging to other users.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Oqtane — Oqtane FrameworkAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-55186",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-55186",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-12-20T20:47:26.903432Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-12-20T16:15:23.853",
  "references": [
    {
      "url": "https://gist.github.com/SmitShah1518/00de9ecc46c1a8e2b189185c9d92afb0",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/oqtane/oqtane.framework/pull/4876/files",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://gist.github.com/SmitShah1518/00de9ecc46c1a8e2b189185c9d92afb0",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An IDOR (Insecure Direct Object Reference) vulnerability exists in oqtane Framework 6.0.0, allowing a logged-in user to access inbox messages of other users by manipulating the notification ID in the request URL. By changing the notification ID, an attacker can view sensitive mail details belonging to other users."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad IDOR (Insecure Direct Object Reference, referencia directa a objetos inseguros) en oqtane Framework 6.0.0, que permite a un usuario conectado acceder a los mensajes de la bandeja de entrada de otros usuarios manipulando el ID de notificación en la URL de solicitud. Al cambiar el ID de notificación, un atacante puede ver detalles confidenciales de correo electrónico que pertenecen a otros usuarios."
    }
  ],
  "lastModified": "2026-06-17T08:11:00.057",
  "sourceIdentifier": "cve@mitre.org"
}