CVE-2024-28087

MEDIUM

Bonitasoft Runtime Community edition's contains an insecure direct object references vulnerability

Title source: GitHub Advisory
STIX 2.1 vulnerability

Record summary

CVE-2024-28087 has a selected CVSS score of 6.5 (medium).

Description

In Bonitasoft runtime Community edition, the lack of dynamic permissions causes IDOR vulnerability. Dynamic permissions existed only in Subscription edition and have now been restored in Community edition, where they are not custmizable.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 20, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

bonita_web

Browse bonitasoft / bonita_web

Default status: unknown

CVE ListBefore 2024.2-u1affected

org.bonitasoft.engine:bonita-server

Browse Maven / org.bonitasoft.engine:bonita-server
GitHub AdvisoryBefore 10.1.0.W11 · Fixed in 10.1.0.W11affected

References

5