CVE-2024-45164

Katalog CVE

CVSS 7.1 · High EPSS 0,31%

Kerentanan Incorrect Authorization pada akamai secure internet access enterprise threatavert. Skor CVSS 3.1 7.1 (High) menurut NVD.

Deskripsi (NVD)

Akamai SIA (Secure Internet Access Enterprise) ThreatAvert, in SPS (Security and Personalization Services) before the latest 19.2.0 patch and Apps Portal before 19.2.0.3 or 19.2.0.20240814, has incorrect authorization controls for the Admin functionality on the ThreatAvert Policy page. An authenticated user can navigate directly to the /#app/intelligence/threatAvertPolicies URI and disable policy enforcement.

Rincian

Terbit di NVD

4 November 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization
CWE-732: Incorrect Permission Assignment for Critical Resource

EPSS (30 hari)

0,31% peluang dieksploitasi; lebih tinggi dari 22,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://notes.netbytesec.com/2024/11/cve-2024-45164-broken-access-control.html exploit · mitigasi · advisory pihak ketiga
• https://www.akamai.com/global-services/support/vulnerability-reporting product