CVE-2024-23329 json
changedetection.io API endpoint is not secured with API token
published 2024-01-19 2 y ago modified 2026-09-10 1 mo ago also GHSA-hcvp-2cc7-jrwr , PYSEC-2024-15 , EUVD-2024-0021
- cvss
- 3.7
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 48%
- public exploits
- 0
- none known
Summary
changedetection.io is an open source tool designed to monitor websites for content changes. In affected versions the API endpoint `/api/v1/watch/<uuid>/history` can be accessed by any unauthorized user. As a result any unauthorized user can check one's watch history. However, because unauthorized party first needs to know a watch UUID, and the watch history endpoint itself returns only paths to the snapshot on the server, an impact on users' data privacy is minimal. This issue has been addressed in version 0.45.13. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Patch / fix
- pypi changedetection-io 0.45.13
- webtechnologies changedetection 0.45.13
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 23 mo ago
Exploit prediction
0.59% chance of exploitation in the next 30 days, higher than 48% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-hcvp-2cc7-jrwr referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N |
| NVD | 3.1 | 3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N |
| OSV | 3.1 | 3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N |
| GitHub | 3.1 | 3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | changedetection-io | >=0.39.14, <0.45.13 |
0.45.13 |
Affected products
- dgtlmoon changedetection.io
Classification
- Weakness
-
- CWE-863 Incorrect Authorization
References
-
github.com
/dgtlmoon/changedetection.io/commit/402f1e47e78ecd155b1e90f30cce424ff7763e0f
web, patch
-
github.com
/dgtlmoon/changedetection.io/security/advisories/GHSA-hcvp-2cc7-jrwr
web, exploit, vendor-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-23329
advisory
-
github.com
/dgtlmoon/changedetection.io
package
-
github.com
/dgtlmoon/changedetection.io/blob/9510345e01ea8e308c339163d8e8b030ce5ac7f1/changedetectionio/api/api_v1.py#L12
web
-
github.com
/pypa/advisory-database/tree/main/vulns/changedetection-io/PYSEC-2024-15.yaml
web
Sources
- CVE List CVE-2024-23329
- GitHub Advisory GHSA-hcvp-2cc7-jrwr
- NVD CVE-2024-23329
- OSV PYSEC-2024-15
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.