Skip to content
OpenAdvisories
High · 8.3 CVE-2024-26139 EUVD-2024-23427GHSA-qx4j-f4f2-vjw9PYSEC-2024-296

OpenCTI Authenticated Privilege Escalation

Published May 23, 2024 · Updated Aug 1, 2024 · Assigned by GitHub_M

Description

OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables. Due to lack of certain security controls on the profile edit functionality, an authenticated attacker with low privileges can gain administrative privileges on the web application.

Affected products

VendorProductAffectedFixed
OpenCTI-Platform opencti <= 5.12.31 —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI pycti < 5.12.32 5.12.32 PYSEC-2024-296

References