What’s Vulnerable › Vulnerabilities

CVE-2024-27455

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-02-26 · updated 2026-06-17
• Weakness: CWE-488

Description

In the Bentley ALIM Web application, certain configuration settings can cause exposure of a user's ALIM session token when the user attempts to download files. This is fixed in Assetwise ALIM Web 23.00.04.04 and Assetwise Information Integrity Server 23.00.02.03.

Affected products

• Bentley Assetwise Alim Web: from 23.00.03 before 23.00.04.04 — fixed in 23.00.04.04
• Bentley Assetwise Information Integrity Server: from 16.9 before 23.00.02.03 — fixed in 23.00.02.03

How to fix

Upgrade to a fixed version: Bentley Assetwise Alim Web 23.00.04.04; Bentley Assetwise Information Integrity Server 23.00.02.03. Check the vendor advisory for mitigations.

References

• https://www.bentley.com/advisories/be-2024-0001/
• https://www.bentley.com/advisories/be-2024-0001/

Get alerted when CVE-2024-27455 or the next vulnerability affects your stack