CVE-2024-42056: CSRF
Published Aug 22, 2024
·Updated
Retool (self-hosted enterprise) through 3.40.0 inserts resource authentication credentials into sent data. Credentials for users with "Use" permissions can be discovered (by an authenticated attacker) via the /api/resources endpoint. The earliest affected version is 3.18.1.
Affected Software
1 affected component
Retool Retool>=3.18.1<=3.40.0
Event History
Aug 22, 2024
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·01:15 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2024-42056?
CVE-2024-42056 is considered a high severity vulnerability due to the exposure of sensitive credentials.
2
How do I fix CVE-2024-42056?
To fix CVE-2024-42056, upgrade Retool to version 3.40.1 or later.
3
Which versions of Retool are affected by CVE-2024-42056?
CVE-2024-42056 affects Retool versions from 3.18.1 to 3.40.0.
4
Who can exploit CVE-2024-42056?
An authenticated attacker with 'Use' permissions can exploit CVE-2024-42056 to discover sensitive credentials.
5
What impact does CVE-2024-42056 have on user data?
CVE-2024-42056 can lead to unauthorized access to user credentials and potentially compromise sensitive information.