CVE-2024-28087

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-05-15 · updated 2026-06-17
Weakness: CWE-284

Description

In Bonitasoft runtime Community edition, the lack of dynamic permissions causes IDOR vulnerability. Dynamic permissions existed only in Subscription edition and have now been restored in Community edition, where they are not custmizable.

Affected products

bonitasoft Bonita Web: before 2024.2-u1 — fixed in 2024.2-u1

How to fix

Upgrade to a fixed version: bonitasoft Bonita Web 2024.2-u1. Check the vendor advisory for mitigations.

References

https://documentation.bonitasoft.com/bonita/2024.1/release-notes#_fixes_in_bonita_2024_1_u0_2024_04_11
https://documentation.bonitasoft.com/bonita/latest/release-notes#_fixes_in_bonita_2024_1_2024_04_11
https://documentation.bonitasoft.com/bonita/latest/release-notes#_fixes_in_bonita_2024_1_2024_04_11

Get alerted when CVE-2024-28087 or the next vulnerability affects your stack