PT-2024-19810 · Unknown · Changedetection.Io

Rozpuszczalny · Published 2024-01-19 · Updated 2024-01-26 · CVE-2024-23329

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions changedetection.io versions prior to 0.45.13

Description The API endpoint /api/v1/watch/<uuid>/history can be accessed by any unauthorized user, allowing them to check one's watch history. However, the impact on users' data privacy is minimal because an unauthorized party first needs to know a watch UUID, and the watch history endpoint itself returns only paths to the snapshot on the server.

Recommendations For versions prior to 0.45.13, upgrade to version 0.45.13 or later to address the issue. As a temporary workaround, consider restricting access to the /api/v1/watch/<uuid>/history API endpoint until the upgrade is applied.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2024-23329

GHSA-HCVP-2CC7-JRWR

PYSEC-2024-15

Affected Products

Changedetection.Io

References · 12

• 🔥 https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-hcvp-2cc7-jrwr · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23329.json · Exploit
• https://github.com/dgtlmoon/changedetection.io/commit/402f1e47e78ecd155b1e90f30cce424ff7763e0f · Patch
• https://osv.dev/vulnerability/PYSEC-2024-15 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-23329 · Security Note
• https://osv.dev/vulnerability/GHSA-hcvp-2cc7-jrwr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-23329 · Vendor Advisory
• https://github.com/dgtlmoon/changedetection.io · Note
• https://github.com/dgtlmoon/changedetection.io/blob/9510345e01ea8e308c339163d8e8b030ce5ac7f1/changedetectionio/api/api_v1.py#L129-L156 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/changedetection-io/PYSEC-2024-15.yaml · Note
• https://twitter.com/VulmonFeeds/status/1748460656842375171 · Twitter Post
• https://twitter.com/CVEnew/status/1748439347676709270 · Twitter Post