CVE-2017-18376

    Dashboard / Vulnerabilities / CVE-2017-18376

    CVE-2017-18376

    Published: 2 Jun 2019Last Modified: 8 Jul 2026

    Summary:

    Details: An improper authorization check in the User API in TheHive before 2.13.4 and 3.x before 3.3.1 allows users with read-only or read/write access to escalate their privileges to the administrator's privileges. This affects app/controllers/UserCtrl.scala.

    References: https://gist.github.com/RaJiska/c1b4521aefd77ed43b06045ca05e2591, https://github.com/TheHive-Project/TheHive/releases/tag/3.3.1, https://github.com/TheHive-Project/TheHive/issues/408

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0b82ae539037893c39e017e6482acef0ec6793e5
    Fixed -d8f0290cde1b802cb1f278f2d03899992a67fa6d

    Affected versions

    3.3.0
    3.3.0-RC6
    3.3.0-RC5
    3.3.0-RC3

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High