CVE-2024-42759

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-42759
An issue in Ellevo v.6.2.0.38160 allows a remote attacker to escalate privileges via the /api/usuario/cadastrodesuplente endpoint.

6.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.8 / Impact : 5.5

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://csflabs.github.io/cve/2024/09/06/cve-2024-42759-approval-of-your-own-ticket-with-BFLA.html Exploit Third Party Advisory
https://ellevo.com/ Product
Configurations

Configuration 1 (hide)

cpe:2.3:a:ellevo:ellevo:6.2.0.38160:*:*:*:*:*:*:*
History

03 Jul 2025, 12:24

Type Values Removed Values Added
CPE cpe:2.3:a:ellevo:ellevo:6.2.0.38160:*:*:*:*:*:*:*
References () https://csflabs.github.io/cve/2024/09/06/cve-2024-42759-approval-of-your-own-ticket-with-BFLA.html - () https://csflabs.github.io/cve/2024/09/06/cve-2024-42759-approval-of-your-own-ticket-with-BFLA.html - Exploit, Third Party Advisory
References () https://ellevo.com/ - () https://ellevo.com/ - Product
First Time Ellevo
Ellevo ellevo

10 Sep 2024, 16:35

Type Values Removed Values Added
CWE CWE-592
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.3

10 Sep 2024, 12:09

Type Values Removed Values Added
Summary
  • (es) Un problema en Ellevo v.6.2.0.38160 permite que un atacante remoto escale privilegios a través del endpoint /api/usuario/cadastrodesuplente.

09 Sep 2024, 19:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-09-09 19:15

Updated : 2025-07-03 12:24

NVD link : CVE-2024-42759

Mitre link : CVE-2024-42759

CVE.ORG link : CVE-2024-42759

JSON object : View

Products Affected

ellevo

  • ellevo
CWE
CWE-592

DEPRECATED: Authentication Bypass Issues