CVE-2024-45408 - CVE House

Back to Database

Status published High CVE-2024-45408

eLabFTW contains a direct and indirect information disclosure

7.5 CVSS

Vulnerability Description

eLabFTW is an open source electronic lab notebook for research labs. An incorrect permission check has been found that could allow an authenticated user to access several kinds of otherwise restricted information. If anonymous access is allowed (something disabled by default), this extends to anyone. Users are advised to upgrade to at least version 5.1.0. System administrators can disable anonymous access in the System configuration panel.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-45408

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

https://github.com/elabftw/elabftw/security/advisories/GHSA-2c83-6j74-w8r5

More from elabftw

View All →

eLabFTW HTML / CSS Injection via Malicious SVG Upload Leads to Credential Theft / Clickjacking

Incorrect input validation could allow an authenticated user to read sensitive information

eLabFTW MFA bypass

eLabFTW vulnerable to HTML Injection in extended search error message

Stored Cross-site Scripting leading to arbitrary actions taken on behalf of users in elabftw

Affected Vendor

elabftw

View all reports →

Affected Software

elabftw

Vulnerable Versions:

>= 4.4.0, < 5.1.0

Timeline

Official Publish: October 1st, 2024

Last Modified: October 1st, 2024

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1078 Valid Accounts

T1213 Data from Information Repositories

T1565.002 Stored Data Manipulation