Vulnerability Description
Tolgee is an open-source localization platform. When API key created by admin user is used it bypasses the permission check at all. This error was introduced in v3.57.2 and immediately fixed in v3.57.4.
CVSS Score
6.5
MEDIUM
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Tolgee | Tolgee | >= 3.57.2, < 3.57.4 |
Related Weaknesses (CWE)
References
- https://github.com/tolgee/tolgee-platform/commit/a0d861028d931f8a54387770eaf3a75Patch
- https://github.com/tolgee/tolgee-platform/security/advisories/GHSA-pm57-hcm8-38gVendor Advisory
- https://github.com/tolgee/tolgee-platform/security/advisories/GHSA-r95p-fqqv-fppNot Applicable
- https://github.com/tolgee/tolgee-platform/commit/a0d861028d931f8a54387770eaf3a75Patch
- https://github.com/tolgee/tolgee-platform/security/advisories/GHSA-pm57-hcm8-38gVendor Advisory
- https://github.com/tolgee/tolgee-platform/security/advisories/GHSA-r95p-fqqv-fppNot Applicable
FAQ
What is CVE-2024-32470?
CVE-2024-32470 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Tolgee is an open-source localization platform. When API key created by admin user is used it bypasses the permission check at all. This error was introduced in v3.57.2 and immediately fixed in v3.57....
How severe is CVE-2024-32470?
CVE-2024-32470 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-32470?
Check the references section above for vendor advisories and patch information. Affected products include: Tolgee Tolgee.