PT-2024-32479 · Unknown · Gladys Assistant

Chasebowman-Contrast · Published 2024-09-21 · Updated 2024-09-26 · CVE-2024-47210

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Gladys Assistant versions prior to 4.45.1

Description The issue allows a user to change their own role, resulting in privilege escalation. This is possible because the req.body.role can be used in the updateMySelf function in server/api/controllers/user.controller.js.

Recommendations For versions prior to 4.45.1, update to version 4.45.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the updateMySelf function in server/api/controllers/user.controller.js to prevent exploitation. Additionally, avoid using the req.body.role variable in the affected API endpoint until the issue is resolved.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2024-47210

Affected Products

Gladys Assistant

References · 11

• https://osv.dev/vulnerability/CVE-2024-47210 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-47210 · Security Note
• https://github.com/GladysAssistant/Gladys/commit/344ad9b8ca3078d9292dd95f2dd7b9172bc6ebbe · Note
• https://github.com/GladysAssistant/Gladys/pull/2115 · Note
• https://github.com/GladysAssistant/Gladys/compare/v4.45.0...v4.45.1 · Note
• https://t.me/cvenotify/95584 · Telegram Post
• https://twitter.com/cracbot/status/1838820813312790788 · Twitter Post
• https://twitter.com/CVEnew/status/1837620782190514349 · Twitter Post
• https://twitter.com/cracbot/status/1839183167712014370 · Twitter Post
• https://t.me/cvedetector/6143 · Telegram Post
• https://twitter.com/cracbot/status/1838458460679344251 · Twitter Post