CVEvulnerability

CVE-2024-12564

6.9 MEDIUM Published 2024-12-12 Modified 2026-06-17 Official page ↗
Status
Deferred
Published
2024-12-12
Last modified
2026-06-17
Assigner
8a9629cb-c5e7-4d2a-a894-111e8039b7ea
CVSS 4.0 (8a9629cb-c5e7-4d2a-a894-111e8039b7ea)
6.9 MEDIUM — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weaknesses
CWE-200, CWE-276, CWE-732

Description

Exposure of Sensitive Information to an Unauthorized Actor vulnerability was discovered in Open Design Alliance CDE inWEB SDK before 2025.3. Installing CDE Server with default settings allows unauthorized users to visit prometheus metrics page. This can allow attackers to understand more things about the target application which may help in further investigation and exploitation.

Related

Weakness · CWE (3)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-276 Incorrect Default Permissions weakness
  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness

References