CVE-2024-32470

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-32470
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-32470.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-32470
Related
  • GHSA-pm57-hcm8-38gw
  • GHSA-r95p-fqqv-fppc
Published
2024-04-18T15:05:26.408Z
Modified
2026-07-08T06:51:14.700846999Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Tolgee' API keys created by server admin users bypass the permission check
Details

Tolgee is an open-source localization platform. When API key created by admin user is used it bypasses the permission check at all. This error was introduced in v3.57.2 and immediately fixed in v3.57.4.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32470.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-863"
    ]
}
References

Affected packages

Git / github.com/tolgee/tolgee-platform

Affected ranges

Type
GIT
Repo
https://github.com/tolgee/tolgee-platform
Events
Introduced
02405d0cc04d708749af479080c41275914b5daf
Fixed
6c1fe3ea6965ea9e647510c80c04accdf01518d0
Fixed
a0d861028d931f8a54387770eaf3a75031b81234
Database specific 
{
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:tolgee:tolgee:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "3.57.2"
        },
        {
            "fixed": "3.57.4"
        }
    ]
}

Affected versions

v3.*
v3.57.2
v3.57.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-32470.json"