CVE-2024-28087 json
Bonitasoft Runtime Community edition's contains an insecure direct object references vulnerability
published 2024-05-15 2 y ago modified 2026-06-17 4 mo ago also GHSA-76v2-48w6-crxr , EUVD-2024-1477
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 24%
- public exploits
- 0
- none known
Summary
In Bonitasoft runtime Community edition, the lack of dynamic permissions causes IDOR vulnerability. Dynamic permissions existed only in Subscription edition and have now been restored in Community edition, where they are not custmizable.
Patch / fix
- maven org.bonitasoft.engine:bonita-server 10.1.0.W11
- bonitasoft bonita_web 2024.2-u1
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.32% chance of exploitation in the next 30 days, higher than 24% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.bonitasoft.engine:bonita-server | <10.1.0.W11 |
10.1.0.W11 |
Affected products
- bonitasoft bonita_web
Classification
References
-
github.com
/bonitasoft/bonita-engine/commit/1b3ac00f0178bfcfe8f01811a249b1893f0b1da1
web
-
documentation.bonitasoft.com
/bonita/latest/release-notes#_fixes_in_bonita_2024_1_2024_04_11
web
-
documentation.bonitasoft.com
/bonita/2024.1/release-notes#_fixes_in_bonita_2024_1_u0_2024_04_11
web
-
nvd.nist.gov
/vuln/detail/CVE-2024-28087
advisory
-
github.com
/bonitasoft/bonita-engine
package
Sources
- CVE List CVE-2024-28087
- GitHub Advisory GHSA-76v2-48w6-crxr
- NVD CVE-2024-28087
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.