CVE-2024-55604
mediumPriorität · verfolgen · 17EPSS 0.003 · 17. PerzentilEUUSEPSS · bewertet 2026-10-27
Appsmith is a platform to build admin panels, internal tools, and dashboards. Users invited as "App Viewer" should not have access to development information of a workspace. Datasources are such a component in a workspace. Yet, in versions of Appsmith prior to 1.51, app viewers are able to get a list of datasources in a workspace they're a member of. This information disclosure does NOT expose sensitive data in the datasources, such as database passwords and API Keys. The attacker needs to have been invited to a workspace as a "viewer", by someone in that workspace with access to invite. The attacker then needs to be able to signup/login to that Appsmith instance. The issue is patched in version 1.51. No known workarounds are available.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · low–medium · 1.1–6.5
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (3)
Betroffene Produkte und Versionsbereiche.
Advisories (3)
Hersteller- und Ökosystem-Meldungen dazu.
- BIT-appsmith-2024-55604Appsmith's Broken Access Control Allows Viewer Role User to Query Datasources2025-04-14vendor · osvUS
Appsmith is a platform to build admin panels, internal tools, and dashboards. Users invited as "App Viewer" should not have access to development information of a workspace. Datasources are such a component in a workspace. Yet, in versions of Appsmith prior to 1.51, app viewers are able to get a list of datasources in a workspace they're a member of. This information disclosure does NOT expose sensitive data in the datasources, such as database passwords and API Keys. The attacker needs to have been invited to a workspace as a "viewer", by someone in that workspace with access to invite. The attacker then needs to be able to signup/login to that Appsmith instance. The issue is patched in version 1.51. No known workarounds are available.
- BIT-appsmith-2024-559652025-07-09vendor · osvUS
An issue was discovered in Appsmith before 1.51. Users invited as "App Viewer" incorrectly have access to development information of a workspace (specifically, a list of datasources in a workspace they're a member of). This information disclosure does not expose sensitive data in the datasources, such as database passwords and API Keys.
- CVE-2024-559652025-03-26vendor · osvUS
An issue was discovered in Appsmith before 1.51. Users invited as "App Viewer" incorrectly have access to development information of a workspace (specifically, a list of datasources in a workspace they're a member of). This information disclosure does not expose sensitive data in the datasources, such as database passwords and API Keys.
auch bekannt als (5)
Weitere Namen und Kennungen dieser Entität.
- CNNVD-202503-2934cnnvd
- EUVD-2024-54485enisa_euvd
- BIT-appsmith-2024-55604osv
- BIT-appsmith-2024-55965osv
- GHSA-794x-gm8v-2wj6osv
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (6)
Externe Belege — Patches, Meldungen, Analysen.
- https://access.redhat.com/security/cve/cve-2024-55604cnnvd
- https://github.com/appsmithorg/appsmith/releases/tag/v1.51Patchcnnvd
- https://github.com/appsmithorg/appsmith/security/advisories/GHSA-794x-gm8v-2wj6cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2024-55604cnnvd
- https://github.com/appsmithorg/appsmith/security/advisories/GHSA-794x-gm8v-2wj6enisa_euvd
- https://github.com/appsmithorg/appsmith/security/advisories/GHSA-794x-gm8v-2wj6Vendor Advisorynvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan