{"id":"CVE-2024-55963","aliases":["BIT-appsmith-2024-55963","EUVD-2024-54312","GHSA-6mc8-hw5c-7qqr"],"status":"published","description":"An issue was discovered in Appsmith before 1.51. A user on Appsmith that doesn't have admin permissions can trigger the restart API on Appsmith, causing a server restart. This is still within the Appsmith container, and the impact is limited to Appsmith's own server only, but there is a denial of service because it can be continually restarted. This is due to incorrect access control checks, which should check for super user permissions on the incoming request.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.32863,"percentile":0.98374,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-284"],"published":"2025-03-26T00:00:00Z","modified":"2026-10-28T02:30:52Z","exploits":[{"source":"exploitdb","id":"EDB-52118","title":"AppSmith 1.47 - Remote Code Execution (RCE)","type":"webapps","platform":"java","date":"2025-04-03","url":"https://www.exploit-db.com/exploits/52118"},{"source":"metasploit","id":"exploit/linux/http/appsmith_rce_cve_2024_55964","title":"Appsmith RCE","type":"exploit","platform":"Linux,Unix","date":"2025-03-25","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/http/appsmith_rce_cve_2024_55964"},{"source":"pocgithub","id":"superswan/CVE-2024-55963","title":"superswan/CVE-2024-55963","date":"2025-07-06","url":"https://github.com/superswan/CVE-2024-55963"}],"fixes":[{"ecosystem":"Bitnami","package":"appsmith","fixed_in":["1.51.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"appsmith","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.51.0"}]}]}],"products":[{"vendor":"appsmith","product":"appsmith"}],"references":[{"url":"https://github.com/appsmithorg/appsmith/security/advisories/GHSA-6mc8-hw5c-7qqr","tags":["Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-55963","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/55xxx/CVE-2024-55963.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-55963","description":"An issue was discovered in Appsmith before 1.51. A user on Appsmith that doesn't have admin permissions can trigger the restart API on Appsmith, causing a server restart. This is still within the Appsmith container, and the impact is limited to Appsmith's own server only, but there is a denial of service because it can be continually restarted. This is due to incorrect access control checks, which should check for super user permissions on the incoming request.","status":"published","published":"2025-03-26T00:00:00Z","modified":"2025-03-27T13:36:32.205Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:34:22.525279Z"}],"euvd":[{"id":"EUVD-2024-54312","description":"An issue was discovered in Appsmith before 1.51. A user on Appsmith that doesn't have admin permissions can trigger the restart API on Appsmith, causing a server restart. This is still within the Appsmith container, and the impact is limited to Appsmith's own server only, but there is a denial of service because it can be continually restarted. This is due to incorrect access control checks, which should check for super user permissions on the incoming request.","status":"published","published":"2025-03-26T00:00:00Z","modified":"2025-03-27T13:36:32Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T20:52:49.948923Z"}],"nvd":[{"id":"CVE-2024-55963","description":"An issue was discovered in Appsmith before 1.51. A user on Appsmith that doesn't have admin permissions can trigger the restart API on Appsmith, causing a server restart. This is still within the Appsmith container, and the impact is limited to Appsmith's own server only, but there is a denial of service because it can be continually restarted. This is due to incorrect access control checks, which should check for super user permissions on the incoming request.","status":"published","published":"2025-03-26T20:15:21.253Z","modified":"2026-06-17T08:11:30.3Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:10:45.815983Z"}],"osv":[{"id":"CVE-2024-55963","description":"An issue was discovered in Appsmith before 1.51. A user on Appsmith that doesn't have admin permissions can trigger the restart API on Appsmith, causing a server restart. This is still within the Appsmith container, and the impact is limited to Appsmith's own server only, but there is a denial of service because it can be continually restarted. This is due to incorrect access control checks, which should check for super user permissions on the incoming request.","status":"published","published":"2025-03-26T00:00:00Z","modified":"2026-10-28T02:30:52.318087391Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:44.777182Z"},{"id":"BIT-appsmith-2024-55963","description":"An issue was discovered in Appsmith before 1.51. A user on Appsmith that doesn't have admin permissions can trigger the restart API on Appsmith, causing a server restart. This is still within the Appsmith container, and the impact is limited to Appsmith's own server only, but there is a denial of service because it can be continually restarted. This is due to incorrect access control checks, which should check for super user permissions on the incoming request.","status":"published","published":"2025-04-02T07:06:56.893Z","modified":"2026-09-08T08:45:47.230978988Z","updated_at":"2026-11-02T15:28:28.267217Z"}]}}