PT-2024-22798 · Oneuptime · Oneuptime

Saunders-Jake · Published 2024-03-24 · Updated 2025-12-05 · CVE-2024-29194

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions OneUptime versions prior to 7.0.1815

Description The issue lies in the improper validation of client-side stored data within the web application. Specifically, the is master admin key, stored in the local storage of the browser, can be manipulated by an attacker. By changing this key from false to true, the application grants administrative privileges to the user, without proper server-side validation. This allows unauthorized access to administrative functionalities and represents a high security risk. An attacker could see the list of users who signed up to OneUptime.

Recommendations For versions prior to 7.0.1815, update to version 7.0.1815 to resolve the issue. As a temporary workaround, consider restricting access to the is master admin key in the local storage to minimize the risk of exploitation.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2024-29194

GHSA-246P-XMG8-WMCQ

Affected Products

Oneuptime

References · 11

• 🔥 https://github.com/OneUptime/oneuptime/security/advisories/GHSA-246p-xmg8-wmcq · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29194.json · Exploit
• https://github.com/OneUptime/oneuptime/commit/14016d23d834038dd65d3a96cf71af04b556a32c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-29194 · Security Note
• https://osv.dev/vulnerability/CVE-2024-29194 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-246p-xmg8-wmcq · Vendor Advisory
• https://github.com/OneUptime/oneuptime · Note
• https://twitter.com/CVEnew/status/1771981385940492301 · Twitter Post
• https://t.me/cvenotify/74525 · Telegram Post
• https://t.me/cveNotify/144932 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1771993908118999402 · Twitter Post