CVE-2024-50967
Published: 17 January 2025
Summary
CVE-2024-50967 is a medium-severity Missing Authorization (CWE-862) vulnerability in Readthedocs (inferred from references). Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 2.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Deeper analysis
The /rest/rights/ REST API endpoint in Becon DATAGerry through version 2.2.0 is affected by an incorrect access control vulnerability, tracked as CVE-2024-50967 and assigned CWE-862. The flaw permits unauthenticated remote access to the endpoint, resulting in unauthorized disclosure of sensitive information. It carries a CVSS 3.1 base score of 6.5 with the vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N.
An attacker with network access can exploit the endpoint directly without credentials or prior authentication to retrieve sensitive rights-related data. The attack requires no privileges and can be performed remotely, though the CVSS rating notes user interaction in the UI:R component.
Public references include documentation for the affected rights API, a GitHub proof-of-concept repository, and a technical write-up detailing the discovery; none of the listed sources describe vendor patches, workarounds, or official mitigation steps. The EPSS score remains flat at a peak of 0.4439 with no indicated rise after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-44628
Vulnerability details
The /rest/rights/ REST API endpoint in Becon DATAGerry through 2.2.0 contains an Incorrect Access Control vulnerability. An attacker can remotely access this endpoint without authentication, leading to unauthorized disclosure of sensitive information.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct unauthenticated network access to public REST API endpoint enables exploitation of public-facing application for sensitive data disclosure.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly limits permitted actions without identification or authentication, preventing unauthenticated access to the /rest/rights/ endpoint.
Enforces approved authorizations for logical access, ensuring the API endpoint requires authentication to access sensitive rights information.
Implements least privilege to restrict access to sensitive information only to authorized users, mitigating unauthorized disclosure via the unauthenticated endpoint.