PT-2025-12805 · Appsmith · Appsmith

Published 2025-03-25 · Updated 2025-10-24 · CVE-2024-55604

Positive Technologies (AI Summary)

CVSS v4.0

4.8

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Appsmith versions prior to 1.51

Description The issue concerns an information disclosure where users invited as "App Viewer" can access development information of a workspace, specifically getting a list of datasources. This does not expose sensitive data such as database passwords and API keys. An attacker must be invited to a workspace as a "viewer" and be able to sign up or log in to the Appsmith instance to exploit this issue.

Recommendations For versions prior to 1.51, update to version 1.51 to resolve the issue. As a temporary workaround, consider restricting access to development information for "App Viewer" roles until the update can be applied.

Exploit

Fix

Weakness Enumeration

CWE-280

Related Identifiers

BIT-APPSMITH-2024-55604

BIT-APPSMITH-2024-55965

CVE-2024-55604

GHSA-794X-GM8V-2WJ6

Affected Products

Appsmith

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/55xxx/CVE-2024-55604.json · Exploit
• https://github.com/appsmithorg/appsmith/security/advisories/GHSA-794x-gm8v-2wj6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-55604 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-appsmith-2024-55965 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-55965 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-55604 · Security Note
• https://osv.dev/vulnerability/BIT-appsmith-2024-55604 · Vendor Advisory
• https://t.me/cveNotify/140253 · Telegram Post
• https://t.me/cvetracker/19889 · Telegram Post
• https://t.me/cvedetector/21107 · Telegram Post
• https://twitter.com/CVEnew/status/1904546913627546040 · Twitter Post