PT-2024-31612 · Elabftw · Elabftw

Anargam · Published 2024-10-01 · Updated 2024-10-04 · CVE-2024-45408

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: eLabFTW versions prior to 5.1.0

Description: An incorrect permission check in eLabFTW, an open source electronic lab notebook, could allow an authenticated user to access restricted information. If anonymous access is enabled, this issue extends to anyone.

Recommendations: For versions prior to 5.1.0, upgrade to at least version 5.1.0. As a temporary workaround, system administrators can disable anonymous access in the System configuration panel.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2024-45408

GHSA-2C83-6J74-W8R5

Affected Products

Elabftw

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45408.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-45408 · Security Note
• https://osv.dev/vulnerability/CVE-2024-45408 · Vendor Advisory
• https://github.com/elabftw/elabftw/security/advisories/GHSA-2c83-6j74-w8r5 · Note
• https://t.me/cvedetector/6756 · Telegram Post
• https://t.me/latest_high_impact_cve/1245 · Telegram Post
• https://twitter.com/CVEnew/status/1841135266041368986 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1841229182467977557 · Twitter Post