GitHub Advisoryadvisory · Maven

GHSA-76v2-48w6-crxr Bonitasoft Runtime Community edition's contains an insecure direct object references vulnerability

MEDIUM Published 2024-05-15 Modified 2024-09-05 Official page ↗
Aliases
CVE-2024-28087
Ecosystem
Maven
Packages
org.bonitasoft.engine:bonita-server
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-284, CWE-639
Reviewed
2024-05-15

Affected packages

• Maven org.bonitasoft.engine:bonita-server: < 10.1.0.W11 → fixed in 10.1.0.W11

Description

In Bonitasoft runtime Community edition, the lack of dynamic permissions causes IDOR vulnerability. Dynamic permissions existed only in Subscription edition and have now been restored in Community edition, where they are not custmizable.

Related

Alias · CVE (1)

  • CVE-2024-28087 In Bonitasoft runtime Community edition, the lack of dynamic permissions causes IDOR vulnerability. vulnerability

Weakness · CWE (2)

  • CWE-284 Improper Access Control weakness
  • CWE-639 Authorization Bypass Through User-Controlled Key weakness

References