What is CVE-2024-10649?

CVE-2024-10649 is a medium-severity vulnerability in Wandb Wandb/openui, classified under Missing Authentication for Critical Function. CVSS score: 6.1/10. Published 2025-02-10.

How severe is CVE-2024-10649?

Medium severity. CVSS v3 base score is 6.1 out of 10.

Auth bypass in Wandb Wandb/openui

CVE-2024-10649

wandb/openui latest commit c945bb859979659add5f490a874140ad17c56a5d contains a vulnerability where unauthenticated endpoints allow file uploads and downloads from an AWS S3 bucket. This can lead to multiple security issues including denial…

Vulnerability class: Broken Authentication

EPSS: 0.003 (18.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

Affected products

Wandb Wandb/openui — versions unspecified

Weakness classification (CWE)

CWE-306 — Missing Authentication for Critical Function

References

security@huntr.dev

Frequently asked questions

What is CVE-2024-10649?: CVE-2024-10649 is a medium-severity vulnerability in Wandb Wandb/openui, classified under Missing Authentication for Critical Function. CVSS score: 6.1/10. Published 2025-02-10.
How severe is CVE-2024-10649?: Medium severity. CVSS v3 base score is 6.1 out of 10.