CVE-2024-55963: Medium severity appsmith vulnerability
An issue was discovered in Appsmith before 1.51. A user on Appsmith that doesn't have admin permissions can trigger the restart API on Appsmith, causing a server restart. This is still within the Appsmith container, and the impact is limited to Appsmith's own server only, but there is a denial of service because it can be continually restarted. This is due to incorrect access control checks, which should check for super user permissions on the incoming request.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-55963?
The severity of CVE-2024-55963 is considered medium as it allows non-admin users to trigger a server restart in Appsmith.
How do I fix CVE-2024-55963?
To fix CVE-2024-55963, upgrade Appsmith to version 1.51 or later.
What is the impact of CVE-2024-55963?
The impact of CVE-2024-55963 is a denial of service condition limited to Appsmith's own server.
Who is affected by CVE-2024-55963?
Any user of Appsmith versions prior to 1.51 without admin permissions is affected by CVE-2024-55963.
What are the conditions for CVE-2024-55963 to be exploited?
CVE-2024-55963 can be exploited when a non-admin user triggers the restart API within the Appsmith environment.