What’s Vulnerable › Vulnerabilities

CVE-2024-52297: Tolgee's configuration all configuration properties leaked in public configuration DTO

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-11-12 · updated 2026-06-17
• Weakness: CWE-200

Description

Tolgee is an open-source localization platform. Tolgee 3.81.1 included the all configuration properties in the PublicConfiguratioDTO publicly exposed to users. This vulnerability is fixed in v3.81.2.

Affected products

• tolgee-platform: 3.81.1

References

• https://github.com/tolgee/tolgee-platform/pull/2481/files#diff-d16735590f0f2db7cd782e2966fa18426b94b5e4030fa8b1f5e00cd55686fe7f
• https://github.com/tolgee/tolgee-platform/pull/2689/files
• https://github.com/tolgee/tolgee-platform/security/advisories/GHSA-3wr3-889v-pgcj

Get alerted when CVE-2024-52297 or the next vulnerability affects your stack