{"id":"CVE-2024-44076","aliases":["EUVD-2024-2645","GHSA-r6ph-5fp2-3w2v"],"status":"published","title":"Microcks's POST /api/import and POST /api/export endpoints allow non-administrator access","description":"In Microcks before 1.10.0, the POST /api/import and POST /api/export endpoints allow non-administrator access.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00603,"percentile":0.49148,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-269","CWE-863"],"published":"2024-08-19T00:00:00Z","modified":"2026-10-28T02:30:44Z","fixes":[{"ecosystem":"Maven","package":"io.github.microcks:microcks-app","fixed_in":["1.10.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"io.github.microcks:microcks-app","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"io.github.microcks:microcks-app","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0"}]}],"versions":["1.0.0","1.0.0-RC1","1.1.0","1.1.1","1.2.0","1.2.1","1.3.0","1.4.0","1.4.1","1.4.1-fix-1","1.4.1-fix-2","1.5.0","1.5.0-RC1","1.5.0-RC2","1.5.1","1.5.1-RC1","1.5.1-fix-1","1.5.2","1.5.2-RC1","1.6.0","1.6.0-RC1","1.6.0-fix-1","1.6.0-fix-2","1.6.1","1.7.0","1.7.0-RC1","1.7.1","1.7.1-fix-1","1.8.0","1.8.0-fix-1","1.8.1","1.8.1-M1","1.9.0","1.9.0-fix-1","1.9.0-fix-2","1.9.1","1.9.1-fix-1"]}],"products":[{"vendor":"microcks","product":"microcks"}],"references":[{"url":"https://github.com/microcks/microcks/issues/1212","tags":["Issue Tracking","Vendor Advisory","report","web"]},{"url":"https://github.com/microcks/microcks/compare/1.9.1-fix-1...1.10.0","tags":["Patch","web"]},{"url":"https://github.com/microcks/microcks/releases/tag/1.10.0","tags":["Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-44076","tags":["advisory"]},{"url":"https://github.com/microcks/microcks/commit/4bb98d76f050710e42f5978877fe70e2f6edabf0","tags":["web"]},{"url":"https://github.com/microcks/microcks/commit/a47d105eb45dac5a0712d6e6bf12b3a4347e5e68","tags":["web"]},{"url":"https://github.com/advisories/GHSA-r6ph-5fp2-3w2v"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/44xxx/CVE-2024-44076.json","tags":["advisory"]},{"url":"https://github.com/microcks/microcks","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-44076","description":"In Microcks before 1.10.0, the POST /api/import and POST /api/export endpoints allow non-administrator access.","status":"published","published":"2024-08-19T00:00:00Z","modified":"2024-08-19T15:58:39.325Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:34:06.48311Z"}],"euvd":[{"id":"EUVD-2024-2645","description":"In Microcks before 1.10.0, the POST /api/import and POST /api/export endpoints allow non-administrator access.","status":"published","published":"2024-08-19T00:00:00Z","modified":"2024-08-19T15:58:39Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:56:15.627163Z"}],"ghsa":[{"id":"GHSA-r6ph-5fp2-3w2v","title":"Microcks's POST /api/import and POST /api/export endpoints allow non-administrator access","description":"In Microcks before 1.10.0, the POST /api/import and POST /api/export endpoints allow non-administrator access.","status":"published","published":"2024-08-19T03:30:48Z","modified":"2024-11-18T16:27:06Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-269","CWE-863"],"updated_at":"2026-11-02T14:38:20.012356Z"}],"nvd":[{"id":"CVE-2024-44076","description":"In Microcks before 1.10.0, the POST /api/import and POST /api/export endpoints allow non-administrator access.","status":"published","published":"2024-08-19T03:15:03.883Z","modified":"2026-06-17T07:52:16.017Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:10:19.135392Z"}],"osv":[{"id":"CVE-2024-44076","description":"In Microcks before 1.10.0, the POST /api/import and POST /api/export endpoints allow non-administrator access.","status":"published","published":"2024-08-19T00:00:00Z","modified":"2026-10-28T02:30:44.513686334Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:42.322107Z"},{"id":"GHSA-r6ph-5fp2-3w2v","title":"Microcks's POST /api/import and POST /api/export endpoints allow non-administrator access","description":"In Microcks before 1.10.0, the POST /api/import and POST /api/export endpoints allow non-administrator access.","status":"published","published":"2024-08-19T03:30:48Z","modified":"2024-11-19T05:38:35.76533Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"},{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-269","CWE-863"],"updated_at":"2026-11-02T15:46:55.480549Z"}]}}