CVE-2024-45408
Last modified
CVE-2024-45408 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. eLabFTW is an open source electronic lab notebook for research labs. An incorrect permission check has been found that could allow an authenticated user to access several kinds of otherwise restricted information. EPSS estimates a 0.39% chance of exploitation in the next 30 days.
Description
eLabFTW is an open source electronic lab notebook for research labs. An incorrect permission check has been found that could allow an authenticated user to access several kinds of otherwise restricted information. If anonymous access is allowed (something disabled by default), this extends to anyone. Users are advised to upgrade to at least version 5.1.0. System administrators can disable anonymous access in the System configuration panel.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Elabftw | Elabftw | >= 4.4.0, < 5.1.0 |
References
- https://github.com/elabftw/elabftw/security/advisories/GHSA-2c83-6j74-w8r5Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-45408?
How severe is CVE-2024-45408?
How do I fix CVE-2024-45408?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-45402Picotls is a TLS protocol library that allows users select d…9.8
- CVE-2024-45403h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and …7.5
- CVE-2024-45404OpenCTI is an open-source cyber threat intelligence platform…8.1
- CVE-2024-45405`gix-path` is a crate of the `gitoxide` project (an implemen…6
- CVE-2024-45406Craft is a content management system (CMS). Craft CMS 5 stor…4.8
- CVE-2024-45407Sunshine is a self-hosted game stream host for Moonlight. Cl…5.3
- CVE-2024-45409The Ruby SAML library is for implementing the client side of…9.8
- CVE-2024-4541The Custom Product List Table plugin for WordPress is vulner…4.3
- CVE-2024-45410Traefik is a golang, Cloud Native Application Proxy. When a …7.5
- CVE-2024-45411Twig is a template language for PHP. Under some circumstance…8.6
- CVE-2024-45412Yeti bridges the gap between CTI and DFIR practitioners by p…7.5
- CVE-2024-45413The HTTPD binary in multiple ZTE routers has a stack-based b…8.1
Are you affected by CVE-2024-45408?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST