一、 漏洞 CVE-2024-55604 基础信息
漏洞标题
Appsmith 的访问控制缺陷允许查看者角色用户查询数据源
来源：AIGC 神龙大模型
漏洞描述信息
N/A
来源：AIGC 神龙大模型
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
来源：AIGC 神龙大模型
漏洞类别
信息暴露
来源：AIGC 神龙大模型
漏洞标题
Appsmith's Broken Access Control Allows Viewer Role User to Query Datasources
来源：美国国家漏洞数据库 NVD
漏洞描述信息
Appsmith is a platform to build admin panels, internal tools, and dashboards. Users invited as "App Viewer" should not have access to development information of a workspace. Datasources are such a component in a workspace. Yet, in versions of Appsmith prior to 1.51, app viewers are able to get a list of datasources in a workspace they're a member of. This information disclosure does NOT expose sensitive data in the datasources, such as database passwords and API Keys. The attacker needs to have been invited to a workspace as a "viewer", by someone in that workspace with access to invite. The attacker then needs to be able to signup/login to that Appsmith instance. The issue is patched in version 1.51. No known workarounds are available.
来源：美国国家漏洞数据库 NVD
CVSS信息
N/A
来源：美国国家漏洞数据库 NVD
漏洞类别
不充分权限或特权的处理不恰当
来源：美国国家漏洞数据库 NVD
二、漏洞 CVE-2024-55604 的公开POC
# POC 描述 源链接 神龙链接
三、漏洞 CVE-2024-55604 的情报信息