What is CVE-2024-45050?

CVE-2024-45050 is a high-severity vulnerability in Lif-Platforms New-Ringer-Server, classified under Missing Authorization. CVSS score: 7.1/10. Published 2024-09-04.

How severe is CVE-2024-45050?

High severity. CVSS v3 base score is 7.1 out of 10.

Is CVE-2024-45050 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Auth bypass in Lif-Platforms New-Ringer-Server

CVE-2024-45050

Ringer server is the server code for the Ringer messaging app. Prior to version 1.3.1, there is an issue with the messages loading route where Ringer Server does not check to ensure that the user loading the conversation is actually a member of that conversation. This allows any user with a Lif Account to load any conversation between two users without permission. This issue had been patched in version 1.3.1. There is no action required for users. Lif Platforms will update their servers with the patch.

Vulnerability class: Broken Access Control

EPSS: 0.003 (26.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N.

Affected products

Lif-platforms New-ringer-server — versions < 1.3.1

Weakness classification (CWE)

CWE-862 — Missing Authorization

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)

Frequently asked questions

What is CVE-2024-45050?: CVE-2024-45050 is a high-severity vulnerability in Lif-Platforms New-Ringer-Server, classified under Missing Authorization. CVSS score: 7.1/10. Published 2024-09-04.
How severe is CVE-2024-45050?: High severity. CVSS v3 base score is 7.1 out of 10.
Is CVE-2024-45050 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.