CVE-2024-46097: High severity testlink vulnerability
TestLink 1.9.20 is vulnerable to Incorrect Access Control in the TestPlan editing section. When a new TestPlan is created, an ID with an incremental value is automatically generated. Using the edit function you can change the tplanid parameter to another ID. The application does not carry out a check on the user's permissions maing it possible to recover the IDs of all the TestPlans (even the administrative ones) and modify them even with minimal privileges.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-46097?
CVE-2024-46097 is considered to have a medium severity due to its potential impact on data integrity and unauthorized access.
How can I fix CVE-2024-46097?
To fix CVE-2024-46097, implement proper access control checks in the TestPlan editing functionality to ensure users cannot edit TestPlans that do not belong to them.
Which versions of TestLink are affected by CVE-2024-46097?
CVE-2024-46097 affects TestLink version 1.9.20 and possibly earlier versions.
What type of vulnerability is CVE-2024-46097?
CVE-2024-46097 is an Incorrect Access Control vulnerability, allowing users to modify TestPlans they should not be able to access.
How does CVE-2024-46097 exploit access control?
CVE-2024-46097 exploits access control by allowing users to manipulate the tplan_id parameter to gain unauthorized access to different TestPlans.