Oqtane.Framework
Oqtane is an open-source developer productivity platform for building modern .NET applications and websites that run on Web, Desktop and Mobile.
View on Github
Activity
- Latest release
- 3d ago
- Total releases
- 71
- Cadence
- ~27 days
- Last 12 months
- 14
Reach
- Stars
- 2.3k
Details
- License
- MIT
- First release
- May 22, 2020
| Version | Released | |
|---|---|---|
10.2.5
patch
| ||
10.2.4
patch
| ||
10.2.3
patch
| ||
10.2.2
patch
| ||
10.2.1
patch
| ||
10.2.0
minor
| ||
10.1.2
patch
| ||
10.1.1
patch
| ||
10.1.0
minor
| ||
10.0.4
patch
| ||
10.0.3
patch
| ||
10.0.2
patch
| ||
10.0.1
patch
| ||
10.0.0
major
| ||
6.2.1
patch
| ||
6.2.0
minor
| ||
6.1.5
patch
| ||
6.1.4
patch
| ||
6.1.3
patch
| ||
6.1.2
patch
| ||
6.1.1
patch
| ||
6.1.0
minor
| ||
6.0.1
patch
| ||
6.0.0
major
3 CVEs
CVE-2024-55186
GHSA-2hr5-cvwp-jr5w
Dec 20, 2024
Oqtane Framework Insecure Direct Object Reference vulnerability
Low
Network
Low
Low
None
An IDOR (Insecure Direct Object Reference) vulnerability exists in Oqtane Framework 6.0.0, allowing a logged-in user to access inbox messages of other users by manipulating the notification ID in the request URL. By changing the notification ID, an attacker can view sensitive mail details belonging to other users. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev
CVE-2024-55470
GHSA-995c-qww8-64fj
Dec 20, 2024
Oqtane Framework Incorrect Access Control vulnerability
High
Network
Low
None
None
Oqtane Framework 6.0.0 is vulnerable to Incorrect Access Control. By manipulating the entityid parameter, attackers can bypass passcode validation and successfully log into the application or access restricted data without proper authorization. The lack of server-side validation exacerbates the issue, as the application relies on client-side information for authentication. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev
CVE-2024-55471
GHSA-hhcw-wwxv-g95c
Dec 20, 2024
Oqtane Framework Insecure Direct Object Reference vulnerability
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Oqtane Framework is vulnerable to Insecure Direct Object Reference (IDOR) in Oqtane.Controllers.UserController. This allows unauthorized users to access sensitive information of other users by manipulating the id parameter. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev | ||
5.2.4
patch
3 CVEs
CVE-2024-55186
GHSA-2hr5-cvwp-jr5w
Dec 20, 2024
Oqtane Framework Insecure Direct Object Reference vulnerability
Low
Network
Low
Low
None
An IDOR (Insecure Direct Object Reference) vulnerability exists in Oqtane Framework 6.0.0, allowing a logged-in user to access inbox messages of other users by manipulating the notification ID in the request URL. By changing the notification ID, an attacker can view sensitive mail details belonging to other users. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev
CVE-2024-55470
GHSA-995c-qww8-64fj
Dec 20, 2024
Oqtane Framework Incorrect Access Control vulnerability
High
Network
Low
None
None
Oqtane Framework 6.0.0 is vulnerable to Incorrect Access Control. By manipulating the entityid parameter, attackers can bypass passcode validation and successfully log into the application or access restricted data without proper authorization. The lack of server-side validation exacerbates the issue, as the application relies on client-side information for authentication. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev
CVE-2024-55471
GHSA-hhcw-wwxv-g95c
Dec 20, 2024
Oqtane Framework Insecure Direct Object Reference vulnerability
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Oqtane Framework is vulnerable to Insecure Direct Object Reference (IDOR) in Oqtane.Controllers.UserController. This allows unauthorized users to access sensitive information of other users by manipulating the id parameter. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev | ||
5.2.3
patch
3 CVEs
CVE-2024-55186
GHSA-2hr5-cvwp-jr5w
Dec 20, 2024
Oqtane Framework Insecure Direct Object Reference vulnerability
Low
Network
Low
Low
None
An IDOR (Insecure Direct Object Reference) vulnerability exists in Oqtane Framework 6.0.0, allowing a logged-in user to access inbox messages of other users by manipulating the notification ID in the request URL. By changing the notification ID, an attacker can view sensitive mail details belonging to other users. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev
CVE-2024-55470
GHSA-995c-qww8-64fj
Dec 20, 2024
Oqtane Framework Incorrect Access Control vulnerability
High
Network
Low
None
None
Oqtane Framework 6.0.0 is vulnerable to Incorrect Access Control. By manipulating the entityid parameter, attackers can bypass passcode validation and successfully log into the application or access restricted data without proper authorization. The lack of server-side validation exacerbates the issue, as the application relies on client-side information for authentication. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev
CVE-2024-55471
GHSA-hhcw-wwxv-g95c
Dec 20, 2024
Oqtane Framework Insecure Direct Object Reference vulnerability
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Oqtane Framework is vulnerable to Insecure Direct Object Reference (IDOR) in Oqtane.Controllers.UserController. This allows unauthorized users to access sensitive information of other users by manipulating the id parameter. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev | ||
5.2.2
patch
3 CVEs
CVE-2024-55186
GHSA-2hr5-cvwp-jr5w
Dec 20, 2024
Oqtane Framework Insecure Direct Object Reference vulnerability
Low
Network
Low
Low
None
An IDOR (Insecure Direct Object Reference) vulnerability exists in Oqtane Framework 6.0.0, allowing a logged-in user to access inbox messages of other users by manipulating the notification ID in the request URL. By changing the notification ID, an attacker can view sensitive mail details belonging to other users. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev
CVE-2024-55470
GHSA-995c-qww8-64fj
Dec 20, 2024
Oqtane Framework Incorrect Access Control vulnerability
High
Network
Low
None
None
Oqtane Framework 6.0.0 is vulnerable to Incorrect Access Control. By manipulating the entityid parameter, attackers can bypass passcode validation and successfully log into the application or access restricted data without proper authorization. The lack of server-side validation exacerbates the issue, as the application relies on client-side information for authentication. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev
CVE-2024-55471
GHSA-hhcw-wwxv-g95c
Dec 20, 2024
Oqtane Framework Insecure Direct Object Reference vulnerability
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Oqtane Framework is vulnerable to Insecure Direct Object Reference (IDOR) in Oqtane.Controllers.UserController. This allows unauthorized users to access sensitive information of other users by manipulating the id parameter. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev | ||
5.2.1
patch
3 CVEs
CVE-2024-55186
GHSA-2hr5-cvwp-jr5w
Dec 20, 2024
Oqtane Framework Insecure Direct Object Reference vulnerability
Low
Network
Low
Low
None
An IDOR (Insecure Direct Object Reference) vulnerability exists in Oqtane Framework 6.0.0, allowing a logged-in user to access inbox messages of other users by manipulating the notification ID in the request URL. By changing the notification ID, an attacker can view sensitive mail details belonging to other users. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev
CVE-2024-55470
GHSA-995c-qww8-64fj
Dec 20, 2024
Oqtane Framework Incorrect Access Control vulnerability
High
Network
Low
None
None
Oqtane Framework 6.0.0 is vulnerable to Incorrect Access Control. By manipulating the entityid parameter, attackers can bypass passcode validation and successfully log into the application or access restricted data without proper authorization. The lack of server-side validation exacerbates the issue, as the application relies on client-side information for authentication. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev
CVE-2024-55471
GHSA-hhcw-wwxv-g95c
Dec 20, 2024
Oqtane Framework Insecure Direct Object Reference vulnerability
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Oqtane Framework is vulnerable to Insecure Direct Object Reference (IDOR) in Oqtane.Controllers.UserController. This allows unauthorized users to access sensitive information of other users by manipulating the id parameter. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev | ||
5.2.0
minor
3 CVEs
CVE-2024-55186
GHSA-2hr5-cvwp-jr5w
Dec 20, 2024
Oqtane Framework Insecure Direct Object Reference vulnerability
Low
Network
Low
Low
None
An IDOR (Insecure Direct Object Reference) vulnerability exists in Oqtane Framework 6.0.0, allowing a logged-in user to access inbox messages of other users by manipulating the notification ID in the request URL. By changing the notification ID, an attacker can view sensitive mail details belonging to other users. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev
CVE-2024-55470
GHSA-995c-qww8-64fj
Dec 20, 2024
Oqtane Framework Incorrect Access Control vulnerability
High
Network
Low
None
None
Oqtane Framework 6.0.0 is vulnerable to Incorrect Access Control. By manipulating the entityid parameter, attackers can bypass passcode validation and successfully log into the application or access restricted data without proper authorization. The lack of server-side validation exacerbates the issue, as the application relies on client-side information for authentication. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev
CVE-2024-55471
GHSA-hhcw-wwxv-g95c
Dec 20, 2024
Oqtane Framework Insecure Direct Object Reference vulnerability
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Oqtane Framework is vulnerable to Insecure Direct Object Reference (IDOR) in Oqtane.Controllers.UserController. This allows unauthorized users to access sensitive information of other users by manipulating the id parameter. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev | ||
5.1.2
patch
3 CVEs
CVE-2024-55186
GHSA-2hr5-cvwp-jr5w
Dec 20, 2024
Oqtane Framework Insecure Direct Object Reference vulnerability
Low
Network
Low
Low
None
An IDOR (Insecure Direct Object Reference) vulnerability exists in Oqtane Framework 6.0.0, allowing a logged-in user to access inbox messages of other users by manipulating the notification ID in the request URL. By changing the notification ID, an attacker can view sensitive mail details belonging to other users. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev
CVE-2024-55470
GHSA-995c-qww8-64fj
Dec 20, 2024
Oqtane Framework Incorrect Access Control vulnerability
High
Network
Low
None
None
Oqtane Framework 6.0.0 is vulnerable to Incorrect Access Control. By manipulating the entityid parameter, attackers can bypass passcode validation and successfully log into the application or access restricted data without proper authorization. The lack of server-side validation exacerbates the issue, as the application relies on client-side information for authentication. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev
CVE-2024-55471
GHSA-hhcw-wwxv-g95c
Dec 20, 2024
Oqtane Framework Insecure Direct Object Reference vulnerability
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Oqtane Framework is vulnerable to Insecure Direct Object Reference (IDOR) in Oqtane.Controllers.UserController. This allows unauthorized users to access sensitive information of other users by manipulating the id parameter. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev | ||
5.1.1
patch
3 CVEs
CVE-2024-55186
GHSA-2hr5-cvwp-jr5w
Dec 20, 2024
Oqtane Framework Insecure Direct Object Reference vulnerability
Low
Network
Low
Low
None
An IDOR (Insecure Direct Object Reference) vulnerability exists in Oqtane Framework 6.0.0, allowing a logged-in user to access inbox messages of other users by manipulating the notification ID in the request URL. By changing the notification ID, an attacker can view sensitive mail details belonging to other users. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev
CVE-2024-55470
GHSA-995c-qww8-64fj
Dec 20, 2024
Oqtane Framework Incorrect Access Control vulnerability
High
Network
Low
None
None
Oqtane Framework 6.0.0 is vulnerable to Incorrect Access Control. By manipulating the entityid parameter, attackers can bypass passcode validation and successfully log into the application or access restricted data without proper authorization. The lack of server-side validation exacerbates the issue, as the application relies on client-side information for authentication. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev
CVE-2024-55471
GHSA-hhcw-wwxv-g95c
Dec 20, 2024
Oqtane Framework Insecure Direct Object Reference vulnerability
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Oqtane Framework is vulnerable to Insecure Direct Object Reference (IDOR) in Oqtane.Controllers.UserController. This allows unauthorized users to access sensitive information of other users by manipulating the id parameter. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev | ||
5.1.0
minor
3 CVEs
CVE-2024-55186
GHSA-2hr5-cvwp-jr5w
Dec 20, 2024
Oqtane Framework Insecure Direct Object Reference vulnerability
Low
Network
Low
Low
None
An IDOR (Insecure Direct Object Reference) vulnerability exists in Oqtane Framework 6.0.0, allowing a logged-in user to access inbox messages of other users by manipulating the notification ID in the request URL. By changing the notification ID, an attacker can view sensitive mail details belonging to other users. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev
CVE-2024-55470
GHSA-995c-qww8-64fj
Dec 20, 2024
Oqtane Framework Incorrect Access Control vulnerability
High
Network
Low
None
None
Oqtane Framework 6.0.0 is vulnerable to Incorrect Access Control. By manipulating the entityid parameter, attackers can bypass passcode validation and successfully log into the application or access restricted data without proper authorization. The lack of server-side validation exacerbates the issue, as the application relies on client-side information for authentication. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev
CVE-2024-55471
GHSA-hhcw-wwxv-g95c
Dec 20, 2024
Oqtane Framework Insecure Direct Object Reference vulnerability
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Oqtane Framework is vulnerable to Insecure Direct Object Reference (IDOR) in Oqtane.Controllers.UserController. This allows unauthorized users to access sensitive information of other users by manipulating the id parameter. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev | ||
5.0.2
patch
3 CVEs
CVE-2024-55186
GHSA-2hr5-cvwp-jr5w
Dec 20, 2024
Oqtane Framework Insecure Direct Object Reference vulnerability
Low
Network
Low
Low
None
An IDOR (Insecure Direct Object Reference) vulnerability exists in Oqtane Framework 6.0.0, allowing a logged-in user to access inbox messages of other users by manipulating the notification ID in the request URL. By changing the notification ID, an attacker can view sensitive mail details belonging to other users. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev
CVE-2024-55470
GHSA-995c-qww8-64fj
Dec 20, 2024
Oqtane Framework Incorrect Access Control vulnerability
High
Network
Low
None
None
Oqtane Framework 6.0.0 is vulnerable to Incorrect Access Control. By manipulating the entityid parameter, attackers can bypass passcode validation and successfully log into the application or access restricted data without proper authorization. The lack of server-side validation exacerbates the issue, as the application relies on client-side information for authentication. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev
CVE-2024-55471
GHSA-hhcw-wwxv-g95c
Dec 20, 2024
Oqtane Framework Insecure Direct Object Reference vulnerability
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Oqtane Framework is vulnerable to Insecure Direct Object Reference (IDOR) in Oqtane.Controllers.UserController. This allows unauthorized users to access sensitive information of other users by manipulating the id parameter. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev | ||
5.0.1
patch
3 CVEs
CVE-2024-55186
GHSA-2hr5-cvwp-jr5w
Dec 20, 2024
Oqtane Framework Insecure Direct Object Reference vulnerability
Low
Network
Low
Low
None
An IDOR (Insecure Direct Object Reference) vulnerability exists in Oqtane Framework 6.0.0, allowing a logged-in user to access inbox messages of other users by manipulating the notification ID in the request URL. By changing the notification ID, an attacker can view sensitive mail details belonging to other users. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev
CVE-2024-55470
GHSA-995c-qww8-64fj
Dec 20, 2024
Oqtane Framework Incorrect Access Control vulnerability
High
Network
Low
None
None
Oqtane Framework 6.0.0 is vulnerable to Incorrect Access Control. By manipulating the entityid parameter, attackers can bypass passcode validation and successfully log into the application or access restricted data without proper authorization. The lack of server-side validation exacerbates the issue, as the application relies on client-side information for authentication. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev
CVE-2024-55471
GHSA-hhcw-wwxv-g95c
Dec 20, 2024
Oqtane Framework Insecure Direct Object Reference vulnerability
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Oqtane Framework is vulnerable to Insecure Direct Object Reference (IDOR) in Oqtane.Controllers.UserController. This allows unauthorized users to access sensitive information of other users by manipulating the id parameter. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev | ||
5.0.0
major
3 CVEs
CVE-2024-55186
GHSA-2hr5-cvwp-jr5w
Dec 20, 2024
Oqtane Framework Insecure Direct Object Reference vulnerability
Low
Network
Low
Low
None
An IDOR (Insecure Direct Object Reference) vulnerability exists in Oqtane Framework 6.0.0, allowing a logged-in user to access inbox messages of other users by manipulating the notification ID in the request URL. By changing the notification ID, an attacker can view sensitive mail details belonging to other users. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev
CVE-2024-55470
GHSA-995c-qww8-64fj
Dec 20, 2024
Oqtane Framework Incorrect Access Control vulnerability
High
Network
Low
None
None
Oqtane Framework 6.0.0 is vulnerable to Incorrect Access Control. By manipulating the entityid parameter, attackers can bypass passcode validation and successfully log into the application or access restricted data without proper authorization. The lack of server-side validation exacerbates the issue, as the application relies on client-side information for authentication. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev
CVE-2024-55471
GHSA-hhcw-wwxv-g95c
Dec 20, 2024
Oqtane Framework Insecure Direct Object Reference vulnerability
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Oqtane Framework is vulnerable to Insecure Direct Object Reference (IDOR) in Oqtane.Controllers.UserController. This allows unauthorized users to access sensitive information of other users by manipulating the id parameter. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev | ||
4.0.6
patch
3 CVEs
CVE-2024-55186
GHSA-2hr5-cvwp-jr5w
Dec 20, 2024
Oqtane Framework Insecure Direct Object Reference vulnerability
Low
Network
Low
Low
None
An IDOR (Insecure Direct Object Reference) vulnerability exists in Oqtane Framework 6.0.0, allowing a logged-in user to access inbox messages of other users by manipulating the notification ID in the request URL. By changing the notification ID, an attacker can view sensitive mail details belonging to other users. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev
CVE-2024-55470
GHSA-995c-qww8-64fj
Dec 20, 2024
Oqtane Framework Incorrect Access Control vulnerability
High
Network
Low
None
None
Oqtane Framework 6.0.0 is vulnerable to Incorrect Access Control. By manipulating the entityid parameter, attackers can bypass passcode validation and successfully log into the application or access restricted data without proper authorization. The lack of server-side validation exacerbates the issue, as the application relies on client-side information for authentication. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev
CVE-2024-55471
GHSA-hhcw-wwxv-g95c
Dec 20, 2024
Oqtane Framework Insecure Direct Object Reference vulnerability
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Oqtane Framework is vulnerable to Insecure Direct Object Reference (IDOR) in Oqtane.Controllers.UserController. This allows unauthorized users to access sensitive information of other users by manipulating the id parameter. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev | ||
4.0.5
patch
3 CVEs
CVE-2024-55186
GHSA-2hr5-cvwp-jr5w
Dec 20, 2024
Oqtane Framework Insecure Direct Object Reference vulnerability
Low
Network
Low
Low
None
An IDOR (Insecure Direct Object Reference) vulnerability exists in Oqtane Framework 6.0.0, allowing a logged-in user to access inbox messages of other users by manipulating the notification ID in the request URL. By changing the notification ID, an attacker can view sensitive mail details belonging to other users. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev
CVE-2024-55470
GHSA-995c-qww8-64fj
Dec 20, 2024
Oqtane Framework Incorrect Access Control vulnerability
High
Network
Low
None
None
Oqtane Framework 6.0.0 is vulnerable to Incorrect Access Control. By manipulating the entityid parameter, attackers can bypass passcode validation and successfully log into the application or access restricted data without proper authorization. The lack of server-side validation exacerbates the issue, as the application relies on client-side information for authentication. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev
CVE-2024-55471
GHSA-hhcw-wwxv-g95c
Dec 20, 2024
Oqtane Framework Insecure Direct Object Reference vulnerability
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Oqtane Framework is vulnerable to Insecure Direct Object Reference (IDOR) in Oqtane.Controllers.UserController. This allows unauthorized users to access sensitive information of other users by manipulating the id parameter. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev | ||
4.0.4
patch
3 CVEs
CVE-2024-55186
GHSA-2hr5-cvwp-jr5w
Dec 20, 2024
Oqtane Framework Insecure Direct Object Reference vulnerability
Low
Network
Low
Low
None
An IDOR (Insecure Direct Object Reference) vulnerability exists in Oqtane Framework 6.0.0, allowing a logged-in user to access inbox messages of other users by manipulating the notification ID in the request URL. By changing the notification ID, an attacker can view sensitive mail details belonging to other users. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev
CVE-2024-55470
GHSA-995c-qww8-64fj
Dec 20, 2024
Oqtane Framework Incorrect Access Control vulnerability
High
Network
Low
None
None
Oqtane Framework 6.0.0 is vulnerable to Incorrect Access Control. By manipulating the entityid parameter, attackers can bypass passcode validation and successfully log into the application or access restricted data without proper authorization. The lack of server-side validation exacerbates the issue, as the application relies on client-side information for authentication. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev
CVE-2024-55471
GHSA-hhcw-wwxv-g95c
Dec 20, 2024
Oqtane Framework Insecure Direct Object Reference vulnerability
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Oqtane Framework is vulnerable to Insecure Direct Object Reference (IDOR) in Oqtane.Controllers.UserController. This allows unauthorized users to access sensitive information of other users by manipulating the id parameter. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev | ||
4.0.3
patch
3 CVEs
CVE-2024-55186
GHSA-2hr5-cvwp-jr5w
Dec 20, 2024
Oqtane Framework Insecure Direct Object Reference vulnerability
Low
Network
Low
Low
None
An IDOR (Insecure Direct Object Reference) vulnerability exists in Oqtane Framework 6.0.0, allowing a logged-in user to access inbox messages of other users by manipulating the notification ID in the request URL. By changing the notification ID, an attacker can view sensitive mail details belonging to other users. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev
CVE-2024-55470
GHSA-995c-qww8-64fj
Dec 20, 2024
Oqtane Framework Incorrect Access Control vulnerability
High
Network
Low
None
None
Oqtane Framework 6.0.0 is vulnerable to Incorrect Access Control. By manipulating the entityid parameter, attackers can bypass passcode validation and successfully log into the application or access restricted data without proper authorization. The lack of server-side validation exacerbates the issue, as the application relies on client-side information for authentication. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev
CVE-2024-55471
GHSA-hhcw-wwxv-g95c
Dec 20, 2024
Oqtane Framework Insecure Direct Object Reference vulnerability
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Oqtane Framework is vulnerable to Insecure Direct Object Reference (IDOR) in Oqtane.Controllers.UserController. This allows unauthorized users to access sensitive information of other users by manipulating the id parameter. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev | ||
4.0.2
patch
3 CVEs
CVE-2024-55186
GHSA-2hr5-cvwp-jr5w
Dec 20, 2024
Oqtane Framework Insecure Direct Object Reference vulnerability
Low
Network
Low
Low
None
An IDOR (Insecure Direct Object Reference) vulnerability exists in Oqtane Framework 6.0.0, allowing a logged-in user to access inbox messages of other users by manipulating the notification ID in the request URL. By changing the notification ID, an attacker can view sensitive mail details belonging to other users. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev
CVE-2024-55470
GHSA-995c-qww8-64fj
Dec 20, 2024
Oqtane Framework Incorrect Access Control vulnerability
High
Network
Low
None
None
Oqtane Framework 6.0.0 is vulnerable to Incorrect Access Control. By manipulating the entityid parameter, attackers can bypass passcode validation and successfully log into the application or access restricted data without proper authorization. The lack of server-side validation exacerbates the issue, as the application relies on client-side information for authentication. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev
CVE-2024-55471
GHSA-hhcw-wwxv-g95c
Dec 20, 2024
Oqtane Framework Insecure Direct Object Reference vulnerability
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Oqtane Framework is vulnerable to Insecure Direct Object Reference (IDOR) in Oqtane.Controllers.UserController. This allows unauthorized users to access sensitive information of other users by manipulating the id parameter. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev | ||
4.0.1
patch
3 CVEs
CVE-2024-55186
GHSA-2hr5-cvwp-jr5w
Dec 20, 2024
Oqtane Framework Insecure Direct Object Reference vulnerability
Low
Network
Low
Low
None
An IDOR (Insecure Direct Object Reference) vulnerability exists in Oqtane Framework 6.0.0, allowing a logged-in user to access inbox messages of other users by manipulating the notification ID in the request URL. By changing the notification ID, an attacker can view sensitive mail details belonging to other users. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev
CVE-2024-55470
GHSA-995c-qww8-64fj
Dec 20, 2024
Oqtane Framework Incorrect Access Control vulnerability
High
Network
Low
None
None
Oqtane Framework 6.0.0 is vulnerable to Incorrect Access Control. By manipulating the entityid parameter, attackers can bypass passcode validation and successfully log into the application or access restricted data without proper authorization. The lack of server-side validation exacerbates the issue, as the application relies on client-side information for authentication. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev
CVE-2024-55471
GHSA-hhcw-wwxv-g95c
Dec 20, 2024
Oqtane Framework Insecure Direct Object Reference vulnerability
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Oqtane Framework is vulnerable to Insecure Direct Object Reference (IDOR) in Oqtane.Controllers.UserController. This allows unauthorized users to access sensitive information of other users by manipulating the id parameter. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev | ||
4.0.0
major
3 CVEs
CVE-2024-55186
GHSA-2hr5-cvwp-jr5w
Dec 20, 2024
Oqtane Framework Insecure Direct Object Reference vulnerability
Low
Network
Low
Low
None
An IDOR (Insecure Direct Object Reference) vulnerability exists in Oqtane Framework 6.0.0, allowing a logged-in user to access inbox messages of other users by manipulating the notification ID in the request URL. By changing the notification ID, an attacker can view sensitive mail details belonging to other users. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev
CVE-2024-55470
GHSA-995c-qww8-64fj
Dec 20, 2024
Oqtane Framework Incorrect Access Control vulnerability
High
Network
Low
None
None
Oqtane Framework 6.0.0 is vulnerable to Incorrect Access Control. By manipulating the entityid parameter, attackers can bypass passcode validation and successfully log into the application or access restricted data without proper authorization. The lack of server-side validation exacerbates the issue, as the application relies on client-side information for authentication. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev
CVE-2024-55471
GHSA-hhcw-wwxv-g95c
Dec 20, 2024
Oqtane Framework Insecure Direct Object Reference vulnerability
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Oqtane Framework is vulnerable to Insecure Direct Object Reference (IDOR) in Oqtane.Controllers.UserController. This allows unauthorized users to access sensitive information of other users by manipulating the id parameter. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev | ||
3.4.3
patch
3 CVEs
CVE-2024-55186
GHSA-2hr5-cvwp-jr5w
Dec 20, 2024
Oqtane Framework Insecure Direct Object Reference vulnerability
Low
Network
Low
Low
None
An IDOR (Insecure Direct Object Reference) vulnerability exists in Oqtane Framework 6.0.0, allowing a logged-in user to access inbox messages of other users by manipulating the notification ID in the request URL. By changing the notification ID, an attacker can view sensitive mail details belonging to other users. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev
CVE-2024-55470
GHSA-995c-qww8-64fj
Dec 20, 2024
Oqtane Framework Incorrect Access Control vulnerability
High
Network
Low
None
None
Oqtane Framework 6.0.0 is vulnerable to Incorrect Access Control. By manipulating the entityid parameter, attackers can bypass passcode validation and successfully log into the application or access restricted data without proper authorization. The lack of server-side validation exacerbates the issue, as the application relies on client-side information for authentication. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev
CVE-2024-55471
GHSA-hhcw-wwxv-g95c
Dec 20, 2024
Oqtane Framework Insecure Direct Object Reference vulnerability
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Oqtane Framework is vulnerable to Insecure Direct Object Reference (IDOR) in Oqtane.Controllers.UserController. This allows unauthorized users to access sensitive information of other users by manipulating the id parameter. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev | ||
3.4.2
patch
3 CVEs
CVE-2024-55186
GHSA-2hr5-cvwp-jr5w
Dec 20, 2024
Oqtane Framework Insecure Direct Object Reference vulnerability
Low
Network
Low
Low
None
An IDOR (Insecure Direct Object Reference) vulnerability exists in Oqtane Framework 6.0.0, allowing a logged-in user to access inbox messages of other users by manipulating the notification ID in the request URL. By changing the notification ID, an attacker can view sensitive mail details belonging to other users. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev
CVE-2024-55470
GHSA-995c-qww8-64fj
Dec 20, 2024
Oqtane Framework Incorrect Access Control vulnerability
High
Network
Low
None
None
Oqtane Framework 6.0.0 is vulnerable to Incorrect Access Control. By manipulating the entityid parameter, attackers can bypass passcode validation and successfully log into the application or access restricted data without proper authorization. The lack of server-side validation exacerbates the issue, as the application relies on client-side information for authentication. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev
CVE-2024-55471
GHSA-hhcw-wwxv-g95c
Dec 20, 2024
Oqtane Framework Insecure Direct Object Reference vulnerability
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Oqtane Framework is vulnerable to Insecure Direct Object Reference (IDOR) in Oqtane.Controllers.UserController. This allows unauthorized users to access sensitive information of other users by manipulating the id parameter. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev | ||
3.4.1
patch
3 CVEs
CVE-2024-55186
GHSA-2hr5-cvwp-jr5w
Dec 20, 2024
Oqtane Framework Insecure Direct Object Reference vulnerability
Low
Network
Low
Low
None
An IDOR (Insecure Direct Object Reference) vulnerability exists in Oqtane Framework 6.0.0, allowing a logged-in user to access inbox messages of other users by manipulating the notification ID in the request URL. By changing the notification ID, an attacker can view sensitive mail details belonging to other users. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev
CVE-2024-55470
GHSA-995c-qww8-64fj
Dec 20, 2024
Oqtane Framework Incorrect Access Control vulnerability
High
Network
Low
None
None
Oqtane Framework 6.0.0 is vulnerable to Incorrect Access Control. By manipulating the entityid parameter, attackers can bypass passcode validation and successfully log into the application or access restricted data without proper authorization. The lack of server-side validation exacerbates the issue, as the application relies on client-side information for authentication. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev
CVE-2024-55471
GHSA-hhcw-wwxv-g95c
Dec 20, 2024
Oqtane Framework Insecure Direct Object Reference vulnerability
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Oqtane Framework is vulnerable to Insecure Direct Object Reference (IDOR) in Oqtane.Controllers.UserController. This allows unauthorized users to access sensitive information of other users by manipulating the id parameter. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev | ||
3.4.0
minor
3 CVEs
CVE-2024-55186
GHSA-2hr5-cvwp-jr5w
Dec 20, 2024
Oqtane Framework Insecure Direct Object Reference vulnerability
Low
Network
Low
Low
None
An IDOR (Insecure Direct Object Reference) vulnerability exists in Oqtane Framework 6.0.0, allowing a logged-in user to access inbox messages of other users by manipulating the notification ID in the request URL. By changing the notification ID, an attacker can view sensitive mail details belonging to other users. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev
CVE-2024-55470
GHSA-995c-qww8-64fj
Dec 20, 2024
Oqtane Framework Incorrect Access Control vulnerability
High
Network
Low
None
None
Oqtane Framework 6.0.0 is vulnerable to Incorrect Access Control. By manipulating the entityid parameter, attackers can bypass passcode validation and successfully log into the application or access restricted data without proper authorization. The lack of server-side validation exacerbates the issue, as the application relies on client-side information for authentication. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev
CVE-2024-55471
GHSA-hhcw-wwxv-g95c
Dec 20, 2024
Oqtane Framework Insecure Direct Object Reference vulnerability
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Oqtane Framework is vulnerable to Insecure Direct Object Reference (IDOR) in Oqtane.Controllers.UserController. This allows unauthorized users to access sensitive information of other users by manipulating the id parameter. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev | ||
3.3.1
patch
3 CVEs
CVE-2024-55186
GHSA-2hr5-cvwp-jr5w
Dec 20, 2024
Oqtane Framework Insecure Direct Object Reference vulnerability
Low
Network
Low
Low
None
An IDOR (Insecure Direct Object Reference) vulnerability exists in Oqtane Framework 6.0.0, allowing a logged-in user to access inbox messages of other users by manipulating the notification ID in the request URL. By changing the notification ID, an attacker can view sensitive mail details belonging to other users. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev
CVE-2024-55470
GHSA-995c-qww8-64fj
Dec 20, 2024
Oqtane Framework Incorrect Access Control vulnerability
High
Network
Low
None
None
Oqtane Framework 6.0.0 is vulnerable to Incorrect Access Control. By manipulating the entityid parameter, attackers can bypass passcode validation and successfully log into the application or access restricted data without proper authorization. The lack of server-side validation exacerbates the issue, as the application relies on client-side information for authentication. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev
CVE-2024-55471
GHSA-hhcw-wwxv-g95c
Dec 20, 2024
Oqtane Framework Insecure Direct Object Reference vulnerability
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Oqtane Framework is vulnerable to Insecure Direct Object Reference (IDOR) in Oqtane.Controllers.UserController. This allows unauthorized users to access sensitive information of other users by manipulating the id parameter. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev | ||
3.3.0
minor
3 CVEs
CVE-2024-55186
GHSA-2hr5-cvwp-jr5w
Dec 20, 2024
Oqtane Framework Insecure Direct Object Reference vulnerability
Low
Network
Low
Low
None
An IDOR (Insecure Direct Object Reference) vulnerability exists in Oqtane Framework 6.0.0, allowing a logged-in user to access inbox messages of other users by manipulating the notification ID in the request URL. By changing the notification ID, an attacker can view sensitive mail details belonging to other users. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev
CVE-2024-55470
GHSA-995c-qww8-64fj
Dec 20, 2024
Oqtane Framework Incorrect Access Control vulnerability
High
Network
Low
None
None
Oqtane Framework 6.0.0 is vulnerable to Incorrect Access Control. By manipulating the entityid parameter, attackers can bypass passcode validation and successfully log into the application or access restricted data without proper authorization. The lack of server-side validation exacerbates the issue, as the application relies on client-side information for authentication. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev
CVE-2024-55471
GHSA-hhcw-wwxv-g95c
Dec 20, 2024
Oqtane Framework Insecure Direct Object Reference vulnerability
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Oqtane Framework is vulnerable to Insecure Direct Object Reference (IDOR) in Oqtane.Controllers.UserController. This allows unauthorized users to access sensitive information of other users by manipulating the id parameter. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev | ||
3.2.1
patch
3 CVEs
CVE-2024-55186
GHSA-2hr5-cvwp-jr5w
Dec 20, 2024
Oqtane Framework Insecure Direct Object Reference vulnerability
Low
Network
Low
Low
None
An IDOR (Insecure Direct Object Reference) vulnerability exists in Oqtane Framework 6.0.0, allowing a logged-in user to access inbox messages of other users by manipulating the notification ID in the request URL. By changing the notification ID, an attacker can view sensitive mail details belonging to other users. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev
CVE-2024-55470
GHSA-995c-qww8-64fj
Dec 20, 2024
Oqtane Framework Incorrect Access Control vulnerability
High
Network
Low
None
None
Oqtane Framework 6.0.0 is vulnerable to Incorrect Access Control. By manipulating the entityid parameter, attackers can bypass passcode validation and successfully log into the application or access restricted data without proper authorization. The lack of server-side validation exacerbates the issue, as the application relies on client-side information for authentication. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev
CVE-2024-55471
GHSA-hhcw-wwxv-g95c
Dec 20, 2024
Oqtane Framework Insecure Direct Object Reference vulnerability
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Oqtane Framework is vulnerable to Insecure Direct Object Reference (IDOR) in Oqtane.Controllers.UserController. This allows unauthorized users to access sensitive information of other users by manipulating the id parameter. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev | ||
3.2.0
minor
3 CVEs
CVE-2024-55186
GHSA-2hr5-cvwp-jr5w
Dec 20, 2024
Oqtane Framework Insecure Direct Object Reference vulnerability
Low
Network
Low
Low
None
An IDOR (Insecure Direct Object Reference) vulnerability exists in Oqtane Framework 6.0.0, allowing a logged-in user to access inbox messages of other users by manipulating the notification ID in the request URL. By changing the notification ID, an attacker can view sensitive mail details belonging to other users. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev
CVE-2024-55470
GHSA-995c-qww8-64fj
Dec 20, 2024
Oqtane Framework Incorrect Access Control vulnerability
High
Network
Low
None
None
Oqtane Framework 6.0.0 is vulnerable to Incorrect Access Control. By manipulating the entityid parameter, attackers can bypass passcode validation and successfully log into the application or access restricted data without proper authorization. The lack of server-side validation exacerbates the issue, as the application relies on client-side information for authentication. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev
CVE-2024-55471
GHSA-hhcw-wwxv-g95c
Dec 20, 2024
Oqtane Framework Insecure Direct Object Reference vulnerability
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Oqtane Framework is vulnerable to Insecure Direct Object Reference (IDOR) in Oqtane.Controllers.UserController. This allows unauthorized users to access sensitive information of other users by manipulating the id parameter. Affected versions
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.3.1
+ 36 more Show less
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
6.0.0
References Updated Dec 20, 2024 · Source: OSV.dev |