Bonita Web Security Vulnerabilities and Issues — Bonita Web CVE List

Lucene search

BonitasoftBonita Web

3 matches found

CVE•added 2024/02/27 10:15 p.m.•3740 views

CVE-2024-26542

Cross Site Scripting vulnerability in Bonitasoft, S.A v.7.14. and fixed in v.9.0.2, 8.0.3, 7.15.7, 7.14.8 allows attackers to execute arbitrary code via a crafted payload to the Groups Display name field.

6.1CVSS7.1AI score0.00105EPSS

CVE•added 2022/06/02 2:15 p.m.•693 views

CVE-2022-25237

Bonita Web 2021.2 is affected by a authentication/authorization bypass vulnerability due to an overly broad exclude pattern used in the RestAPIAuthorizationFilter. By appending ;i18ntranslation or /../i18ntranslation/ to the end of a URL, users with no privileges can access privileged API endpoints...

9.8CVSS9.6AI score0.77961EPSS

CVE•added 2024/05/15 5:15 p.m.•68 views

CVE-2024-28087

In Bonitasoft runtime Community edition, the lack of dynamic permissions causes IDOR vulnerability. Dynamic permissions existed only in Subscription edition and have now been restored in Community edition, where they are not custmizable.

6.5CVSS6.8AI score0.00064EPSS