cve/2024/CVE-2024-45805.md

### [CVE-2024-45805](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45805)
![](https://img.shields.io/static/v1?label=Product&message=opencti&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3C%206.3.0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-200%3A%20Exposure%20of%20Sensitive%20Information%20to%20an%20Unauthorized%20Actor&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-285%3A%20Improper%20Authorization&color=brightgreen)

### Description

OpenCTI is an open-source cyber threat intelligence platform. Before 6.3.0, general users can access information that can only be accessed by users with access privileges to admin and support information (SETTINGS_SUPPORT). This is due to inadequate access control for support information (http://<opencti_domain>/storage/get/support/UUID/UUID.zip), and that the UUID is available to general users using an attached query (logs query). This vulnerability is fixed in 6.3.0.

### POC

#### Reference
- https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-42mm-c8x3-g5q6

#### Github
No PoCs found on GitHub currently.