What is GHSA-hhcw-wwxv-g95c?

GHSA-hhcw-wwxv-g95c is a security advisory published by GitHub Security Advisories with Medium severity. Oqtane Framework Insecure Direct Object Reference vulnerability

Which CVE IDs does GHSA-hhcw-wwxv-g95c cover?

GHSA-hhcw-wwxv-g95c covers the following CVE IDs: CVE-2024-55471. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hhcw-wwxv-g95c?

GHSA-hhcw-wwxv-g95c has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-hhcw-wwxv-g95c?

GHSA-hhcw-wwxv-g95c affects 2 products, including: nuget/Oqtane.Framework:\u003c= 6.0.0; nuget/Oqtane.Server:\u003c= 6.0.0.

GHSA-hhcw-wwxv-g95cMediumCVSS 6.5

Oqtane Framework Insecure Direct Object Reference vulnerability

Vendor

GitHub Security Advisories

Published

December 20, 2024

Last Modified

December 20, 2024

🔗 CVE IDs covered (1)

CVE-2024-55471 →

📋 Description

Oqtane Framework is vulnerable to Insecure Direct Object Reference (IDOR) in Oqtane.Controllers.UserController. This allows unauthorized users to access sensitive information of other users by manipulating the id parameter.

🎯 Affected products2

nuget/Oqtane.Framework:<= 6.0.0
nuget/Oqtane.Server:<= 6.0.0

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2024-55471
https://github.com/oqtane/oqtane.framework/pull/4880/files
https://medium.com/@Rudra_2158/cve-2024-55471-breaking-down-the-idor-vulnerability-in-oqtane-framework-c0f4b02f12fc
https://github.com/advisories/GHSA-hhcw-wwxv-g95c