VULNERABILITY INTELLIGENCE

CVE-2024-6322

CVSS score4.4 MEDIUM
EPSS probability0.30%
CISA KEVNot currently listed
Published2024-08-20
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:L

Description

Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associated access to any other data source, as the ReqActions check was not scoped to each specific datasource. The account must have prior query access to the impacted datasource.

Weakness classification

  • CWE-266: Incorrect Privilege Assignment

Primary references