Vulnerability Details CVE-2024-32470
Tolgee is an open-source localization platform. When API key created by admin user is used it bypasses the permission check at all. This error was introduced in v3.57.2 and immediately fixed in v3.57.4.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 53.1%
CVSS Severity
CVSS v3 Score 6.5
References
- https://github.com/tolgee/tolgee-platform/commit/a0d861028d931f8a54387770eaf3a75031b81234
- https://github.com/tolgee/tolgee-platform/security/advisories/GHSA-pm57-hcm8-38gw
- https://github.com/tolgee/tolgee-platform/security/advisories/GHSA-r95p-fqqv-fppc
- https://github.com/tolgee/tolgee-platform/commit/a0d861028d931f8a54387770eaf3a75031b81234
- https://github.com/tolgee/tolgee-platform/security/advisories/GHSA-pm57-hcm8-38gw
- https://github.com/tolgee/tolgee-platform/security/advisories/GHSA-r95p-fqqv-fppc