CVE-2024-51992

Orchid is a @laravel package that allows for rapid application development of back-office applications, admin/user panels, and dashboards. This vulnerability is a method exposure issue (CWE-749: Exposed Dangerous Method or Function) in the Orchid Platform’s asynchronous modal functionality, affecting users of Orchid Platform version 8 through 14.42.x. Attackers could exploit this vulnerability to call arbitrary methods within the `Screen` class, leading to potential brute force of database tables, validation checks against user credentials, and disclosure of the server’s real IP address. The issue has been patched in the latest release, version 14.43.0, released on November 6, 2024. Users should upgrade to version 14.43.0 or later to address this vulnerability. If upgrading to version 14.43.0 is not immediately possible, users can mitigate the vulnerability by implementing middleware to intercept and validate requests to asynchronous modal endpoints, allowing only approved methods and parameters.

• CWE-749

• https://github.com/orchidsoftware/platform/security/advisories/GHSA-cm46-gqf4-mv4f

Published

Nov 11, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-51987Duende.AccessTokenManagement.OpenIdConnect is a set of .NET …5.4
• CVE-2024-51988RabbitMQ is a feature rich, multi-protocol messaging and str…6.5
• CVE-2024-51989Password Pusher is an open source application to communicate…7.1
• CVE-2024-5199The Spotify Play Button WordPress plugin through 1.0 does no…5.4
• CVE-2024-51990jj, or Jujutsu, is a Git-compatible VCS written in rust. In …9.3
• CVE-2024-51991October is a Content Management System (CMS) and web platfor…4.9
• CVE-2024-51993Combodo iTop is a web based IT Service Management tool. An a…3.4
• CVE-2024-51994Combodo iTop is a web based IT Service Management tool. In a…5.4
• CVE-2024-51995Combodo iTop is a web based IT Service Management tool. An a…7.1
• CVE-2024-51996Symphony process is a module for the Symphony PHP framework …7.5
• CVE-2024-51997Trustee is a set of tools and components for attesting confi…8.1
• CVE-2024-51998changedetection.io is a free open source web page change det…8.6