CVE-2024-51479

🗓️ 17 Dec 2024 18:13:02Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 425 Views🌐 WEB

Authorization bypass in Next.js allows access to root directory pages; patched in version 14.2.15.

Reporter	Title	Published	Views	Family All 20
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Event Processing	3 Mar 202517:21	–	ibm
IBM Security Bulletins	Security Bulletin: Components with known vulnerabilities in IBM QRadar Pre-Validation App for IBM QRadar SIEM	2 Mar 202618:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component is vulnerable to next-12.3.4.tgz CVE-2024-51479	1 Apr 202510:40	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security QRadar Analyst Workflow for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	3 Apr 202514:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Rhapsody Systems Engineering is using next-14.2.12.tgz which is vulnerable to CVE-2024-51479	9 Jun 202511:29	–	ibm
BDU FSTEC	The vulnerability of the Next.js software platform for creating web applications stems from deficiencies in the authentication process, which allows attackers to circumvent security restrictions.	20 Dec 202400:00	–	bdu_fstec
Circl	CVE-2024-51479	17 Dec 202418:25	–	circl
CNNVD	Next.js 授权问题漏洞	17 Dec 202400:00	–	cnnvd
Cvelist	CVE-2024-51479 Authorization bypass in Next.js	17 Dec 202418:13	–	cvelist
Github Security Blog	Next.js authorization bypass vulnerability	17 Dec 202415:09	–	github

NVD

Vulners

Node

vercel next.jsRange9.5.5–14.2.15node.js

[
  {
    "vendor": "vercel",
    "product": "next.js",
    "versions": [
      {
        "version": ">= 9.5.5, < 14.2.15",
        "status": "affected"
      }
    ]
  }
]