More information about this CVE will likely be available in a few days

Description

Retool (self-hosted enterprise) through 3.40.0 inserts resource authentication credentials into sent data. Credentials for users with "Use" permissions can be discovered (by an authenticated attacker) via the /api/resources endpoint. The earliest affected version is 3.18.1.

Related CPE's

Could not find any relations

References

https://docs.retool.com/disclosures/cve-2024-42056

https://docs.retool.com/releases

Weaknesses

Could not find any weaknesses

CVSS impact metrics

Could not find any metrics

Information

Source identifier

[email protected]

Vulnerability status

Awaiting analysis

Published

2024-08-22T01:15:03.460

3 weeks ago

Last modified

2024-08-22T12:48:02.790

3 weeks ago