CVE-2024-55963

An issue was discovered in Appsmith before 1.51. A user on Appsmith that doesn't have admin permissions can trigger the restart API on Appsmith, causing a server restart. This is still within the Appsmith container, and the impact is limited to Appsmith's own server only, but there is a denial of service because it can be continually restarted. This is due to incorrect access control checks, which should check for super user permissions on the incoming request.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/appsmithorg/appsmith/security/advisories/GHSA-6mc8-hw5c-7qqr	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:appsmith:appsmith:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-03-26 20:15

Updated : 2025-04-01 16:34

NVD link : CVE-2024-55963

Mitre link : CVE-2024-55963

CVE.ORG link : CVE-2024-55963

JSON object : View

Products Affected

appsmith

appsmith

CWE

CWE-284

Improper Access Control

{"id": "CVE-2024-55963", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2025-03-26T20:15:21.253", "references": [{"url": "https://github.com/appsmithorg/appsmith/security/advisories/GHSA-6mc8-hw5c-7qqr", "tags": ["Vendor Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Appsmith before 1.51. A user on Appsmith that doesn't have admin permissions can trigger the restart API on Appsmith, causing a server restart. This is still within the Appsmith container, and the impact is limited to Appsmith's own server only, but there is a denial of service because it can be continually restarted. This is due to incorrect access control checks, which should check for super user permissions on the incoming request."}, {"lang": "es", "value": "Se detect\u00f3 un problema en Appsmith antes de la versi\u00f3n 1.51. Un usuario de Appsmith sin permisos de administrador puede activar la API de reinicio, lo que provoca el reinicio del servidor. Esto ocurre dentro del contenedor de Appsmith y el impacto se limita a su propio servidor, pero se produce una denegaci\u00f3n de servicio porque puede reiniciarse continuamente. Esto se debe a comprobaciones de control de acceso incorrectas, que deber\u00edan verificar los permisos de superusuario en la solicitud entrante."}], "lastModified": "2025-04-01T16:34:41.947", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:appsmith:appsmith:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "76EC9A47-0E39-4CA8-AB1A-74F4CF8CEECF", "versionEndExcluding": "1.51"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}