PT-2025-13006 · Appsmith · Appsmith

Published 2025-03-26 · Updated 2025-07-09 · CVE-2024-55965

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Appsmith versions prior to 1.51

Description An issue was discovered where users invited as "App Viewer" incorrectly have access to development information of a workspace, specifically a list of datasources in a workspace they're a member of. This information disclosure does not expose sensitive data in the datasources, such as database passwords and API Keys.

Recommendations For versions prior to 1.51, update to version 1.51 or later to resolve the issue. As a temporary workaround, consider restricting access to development information for "App Viewer" users until the update is applied.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BIT-APPSMITH-2024-55604

BIT-APPSMITH-2024-55965

CVE-2024-55965

GHSA-794X-GM8V-2WJ6

Affected Products

Appsmith

References · 11

• https://osv.dev/vulnerability/BIT-appsmith-2024-55965 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-55965 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-55604 · Security Note
• https://osv.dev/vulnerability/CVE-2024-55965 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-appsmith-2024-55604 · Vendor Advisory
• https://github.com/appsmithorg/appsmith/security/advisories/GHSA-794x-gm8v-2wj6 · Note
• https://t.me/cvenotify/128044 · Telegram Post
• https://twitter.com/CVEnew/status/1904995303553384666 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1905052518956085760 · Twitter Post
• https://t.me/cvetracker/20010 · Telegram Post
• https://t.me/cvedetector/21244 · Telegram Post