CVEvulnerability

CVE-2024-45164

7.1 HIGH Published 2024-11-04 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2024-11-04
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-732, CWE-863

Description

Akamai SIA (Secure Internet Access Enterprise) ThreatAvert, in SPS (Security and Personalization Services) before the latest 19.2.0 patch and Apps Portal before 19.2.0.3 or 19.2.0.20240814, has incorrect authorization controls for the Admin functionality on the ThreatAvert Policy page. An authenticated user can navigate directly to the /#app/intelligence/threatAvertPolicies URI and disable policy enforcement.

Affected configurations

• akamai secure internet access enterprise threatavert 19.2.0.2

Related

Weakness · CWE (2)

  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness
  • CWE-863 Incorrect Authorization weakness

References