CVSS 3.1
4.3 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NCVE-2024-45805
Medium (4.3) in citeum opencti. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in pycti 6.3.0.
OpenCTI is an open-source cyber threat intelligence platform. Before 6.3.0, general users can access information that can only be accessed by users with access privileges to admin and support information (SETTINGS_SUPPORT). This is due to inadequate access control for support information (http://<opencti_domain>/storage/get/support/UUID/UUID.zip), and that the UUID is available to general users using an attached query (logs query). This vulnerability is fixed in 6.3.0.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 22% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-200, CWE-285
- Published
- Modified
- Record from
- the NVD, synced
Affected
- citeum:opencti
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| PYSEC-2024-298 | PyPI | pycti | <6.3.0 | 6.3.0 |