Access Control Flaw in OpenCTI Cyber Threat Intelligence Platform

CVE-2024-45805

What is CVE-2024-45805?

An access control vulnerability in the OpenCTI Cyber Threat Intelligence Platform allows general users to obtain sensitive information typically restricted to privileged users, including admin and support data. This vulnerability arises from insufficient access controls affecting the retrieval of support information through exposed endpoints. Specifically, unauthorized individuals can access support data using a UUID that was not adequately protected against general queries. The issue has been remediated in version 6.3.0, emphasizing the importance of updating to protect sensitive data from unauthorized exposure.

References