CVEvulnerability

CVE-2024-29194

8.3 HIGH Published 2024-03-24 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2024-03-24
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.3 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Weaknesses
CWE-639

Description

OneUptime is a solution for monitoring and managing online services. The vulnerability lies in the improper validation of client-side stored data within the web application. Specifically, the is_master_admin key, stored in the local storage of the browser, can be manipulated by an attacker. By changing this key from false to true, the application grants administrative privileges to the user, without proper server-side validation. This has been patched in 7.0.1815.

Affected configurations

• hackerbay oneuptime (>= 7.0.1803 < 7.0.1815)

Related

Weakness · CWE (1)

  • CWE-639 Authorization Bypass Through User-Controlled Key weakness

References