dgtlmoon changedetection.io up to 0.45.12 API Endpoint /api/v1/watch/history authorization

Summaryinfo

A vulnerability was found in dgtlmoon changedetection.io up to 0.45.12. It has been classified as problematic. Affected is an unknown function of the file /api/v1/watch/history of the component API Endpoint. Performing a manipulation results in authorization. This vulnerability was named CVE-2024-23329. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as problematic has been found in dgtlmoon changedetection.io up to 0.45.12. This affects an unknown code block of the file /api/v1/watch/history of the component API Endpoint. The manipulation with an unknown input leads to a authorization vulnerability. CWE is classifying the issue as CWE-863. The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions. This is going to have an impact on confidentiality. The summary by CVE is:

changedetection.io is an open source tool designed to monitor websites for content changes. In affected versions the API endpoint `/api/v1/watch/<uuid>/history` can be accessed by any unauthorized user. As a result any unauthorized user can check one's watch history. However, because unauthorized party first needs to know a watch UUID, and the watch history endpoint itself returns only paths to the snapshot on the server, an impact on users' data privacy is minimal. This issue has been addressed in version 0.45.13. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The weakness was presented 01/19/2024 as GHSA-hcvp-2cc7-jrwr. The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2024-23329 since 01/15/2024. Technical details are known, but no exploit is available.

Upgrading to version 0.45.13 eliminates this vulnerability. Applying the patch 402f1e47e78ecd155b1e90f30cce424ff7763e0f is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• dgtlmoon

Name

• changedetection.io

Version

• 0.45.0
• 0.45.1
• 0.45.2
• 0.45.3
• 0.45.4
• 0.45.5
• 0.45.6
• 0.45.7
• 0.45.8
• 0.45.9
• 0.45.10
• 0.45.11
• 0.45.12

License

• open-source

Website

• Product: https://github.com/dgtlmoon/changedetection.io/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion