How severe is CVE-2024-10649?

This vulnerability has a severity rating of MEDIUM with a CVSS score of 6.1 out of 10.

What type of vulnerability is CVE-2024-10649?

This is classified as CWE-306, which is a common weakness in software security.

CVE-2024-10649 - MEDIUM Severity | CVSS 6.1

Vulnerability Description

wandb/openui latest commit c945bb859979659add5f490a874140ad17c56a5d contains a vulnerability where unauthenticated endpoints allow file uploads and downloads from an AWS S3 bucket. This can lead to multiple security issues including denial of service, stored XSS, and information disclosure. The affected endpoints are '/v1/share/{id:str}' for uploading and '/v1/share/{id:str}' for downloading JSON files. The lack of authentication allows any user to upload and overwrite files, potentially causing the S3 bucket to run out of space, injecting malicious scripts, and accessing sensitive information.

Related Vulnerabilities

CVE-2018-9119

MEDIUM

CVSS:6.1(Medium)

An attacker with physical access to a BrilliantTS FUZE card (MCU firmware 0.1.73, BLE firmware 0.7.4) can unlock the card, extract credit card numbers, and tamper with data on the card via Bluetooth b...

CWE-3062018

CVE-2019-16243

MEDIUM

CVSS:6.1(Medium)

On TCL Alcatel Cingular Flip 2 B9HUAH1 devices, there is an undocumented web API that allows unprivileged JavaScript, including JavaScript running within the KaiOS browser, to view and edit the device...

CWE-3062019

CVE-2019-19143

MEDIUM

CVSS:6.1(Medium)

TP-LINK TL-WR849N 0.9.1 4.16 devices do not require authentication to replace the firmware via a POST request to the cgi/softup URI.

CWE-3062019

CVE-2020-12621

MEDIUM

CVSS:6.1(Medium)

The Teamwire application 5.3.0 for Android allows physically proximate attackers to exploit a flaw related to the pass-code component.

CWE-3062020

CVE-2021-1246

MEDIUM

CVSS:6.1(Medium)

Cisco Finesse, Cisco Virtualized Voice Browser, and Cisco Unified CVP OpenSocial Gadget Editor Unauthenticated Access Vulnerability A vulnerability in the web management interface of Cisco Finesse, Ci...

CWE-3062021

CVE-2021-31814

MEDIUM

CVSS:6.1(Medium)

In Stormshield 1.1.0, and 2.1.0 through 2.9.0, an attacker can block a client from accessing the VPN and can obtain sensitive information through the SN VPN SSL Client.

CWE-3062021