CVE-2024-28087
Bonitasoft Runtime Community edition's contains an insecure direct object references vulnerability
In Bonitasoft runtime Community edition, the lack of dynamic permissions causes IDOR vulnerability. Dynamic permissions existed only in Subscription edition and have now been restored in Community edition, where they are not custmizable.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
In Bonitasoft runtime Community edition, the lack of dynamic permissions causes IDOR vulnerability. Dynamic permissions existed only in Subscription edition and have now been restored in Community edition, where they are not custmizable.
- Record
CVE-2024-28087- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
EUVDEUVD-2024-1477
In Bonitasoft runtime Community edition, the lack of dynamic permissions causes IDOR vulnerability. Dynamic permissions existed only in Subscription edition and have now been restored in Community edition, where they are not custmizable.
- Record
EUVD-2024-1477- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-76v2-48w6-crxr
Bonitasoft Runtime Community edition's contains an insecure direct object references vulnerability
In Bonitasoft runtime Community edition, the lack of dynamic permissions causes IDOR vulnerability. Dynamic permissions existed only in Subscription edition and have now been restored in Community edition, where they are not custmizable.
- Record
GHSA-76v2-48w6-crxr- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-284, CWE-639
- Updated
- 2026-11-02
NVD
In Bonitasoft runtime Community edition, the lack of dynamic permissions causes IDOR vulnerability. Dynamic permissions existed only in Subscription edition and have now been restored in Community edition, where they are not custmizable.
- Record
CVE-2024-28087- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
OSVGHSA-76v2-48w6-crxr
Bonitasoft Runtime Community edition's contains an insecure direct object references vulnerability
In Bonitasoft runtime Community edition, the lack of dynamic permissions causes IDOR vulnerability. Dynamic permissions existed only in Subscription edition and have now been restored in Community edition, where they are not custmizable.
- Record
GHSA-76v2-48w6-crxr- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-284, CWE-639
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.bonitasoft.engine:bonita-serverMaven |
before 10.1.0.W11 | 10.1.0.W11 |
org.bonitasoft.engine:bonita-serverMaven |
before 10.1.0.W11, plus listed versions 10.0.010.1.06.1.06.1.16.1.2 Show 45 moreShow less6.2.06.2.16.2.26.2.36.2.46.2.56.2.66.3.06.3.16.3.26.3.36.3.46.3.56.3.66.3.76.3.86.3.96.4.06.4.16.4.26.5.06.5.16.5.26.5.36.5.47.0.07.0.17.0.27.0.37.1.07.1.27.1.37.1.47.1.57.10.07.10.17.10.37.10.47.10.57.10.67.11.07.11.17.11.27.11.37.11.4 |
10.1.0.W11 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-28087 is a medium vulnerability (CVSS 6.5) in Bonitasoft Bonita Web, published May 15, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 24th percentile. Fixed in org.bonitasoft.engine:bonita-server 10.1.0.W11.
References
documentation.bonitasoft.com/bonita/latest/release-notes
nvd.nist.gov/vuln/detail/CVE-2024-28087
github.com/bonitasoft/bonita-engine/commit/1b3ac00f0178bfcfe8f01811a249b1893f0b1da1
Left out here: 45 versions. The JSON record has them.