fkie_cve-2025-46732
Vulnerability from fkie_nvd
Published
2025-07-18 15:15
Modified
2025-08-05 18:09
Severity ?
Summary
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.6.6, an IDOR vulnerability in the GrapQL `NotificationLineNotificationMarkReadMutation` and `NotificationLineNotificationDeleteMutation` mutations of OpenCTI allows an authenticated user to change the read status of a notification or delete a notification of another user in case he has knowledge of the UUID of the notification. When changing the read status of a notification, the user also receives the content of the notification they changed the read status of. Authenticated Users in OpenCTI can read, modify and delete notification of other users if they know the UUID of the notification. Version 6.6.6 fixes the issue.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:citeum:opencti:*:*:*:*:*:*:*:*",
"matchCriteriaId": "792412E5-AAC8-4DFD-87B0-17DA2B5F8DB5",
"versionEndExcluding": "6.6.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.6.6, an IDOR vulnerability in the GrapQL `NotificationLineNotificationMarkReadMutation` and `NotificationLineNotificationDeleteMutation` mutations of OpenCTI allows an authenticated user to change the read status of a notification or delete a notification of another user in case he has knowledge of the UUID of the notification. When changing the read status of a notification, the user also receives the content of the notification they changed the read status of. Authenticated Users in OpenCTI can read, modify and delete notification of other users if they know the UUID of the notification. Version 6.6.6 fixes the issue."
},
{
"lang": "es",
"value": "OpenCTI es una plataforma de c\u00f3digo abierto para la gesti\u00f3n de informaci\u00f3n y observables sobre ciberamenazas. Antes de la versi\u00f3n 6.6.6, una vulnerabilidad IDOR en las mutaciones GrapQL `NotificationLineNotificationMarkReadMutation` y `NotificationLineNotificationDeleteMutation` de OpenCTI permit\u00eda a un usuario autenticado cambiar el estado de lectura de una notificaci\u00f3n o eliminar la de otro usuario si conoc\u00eda su UUID. Al cambiar el estado de lectura de una notificaci\u00f3n, el usuario tambi\u00e9n recib\u00eda el contenido de la notificaci\u00f3n cuyo estado de lectura hab\u00eda cambiado. Los usuarios autenticados en OpenCTI pueden leer, modificar y eliminar las notificaciones de otros usuarios si conoc\u00edan su UUID. La versi\u00f3n 6.6.6 corrige este problema."
}
],
"id": "CVE-2025-46732",
"lastModified": "2025-08-05T18:09:29.483",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.5,
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
},
"published": "2025-07-18T15:15:27.200",
"references": [
{
"source": "security-advisories@github.com",
"tags": [
"Vendor Advisory"
],
"url": "https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-535g-qp2c-h7vp"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-285"
}
],
"source": "security-advisories@github.com",
"type": "Primary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…