What’s Vulnerable › Vulnerabilities
CVE-2024-52528: Auth Token can be passed dummy or wrong the middleware response is 200 OK
- Severity: critical (CVSS 9.3 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.6% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-11-15 · updated 2026-06-17
- Weakness: CWE-285
Description
Budget Control Gateway acts as an entry point for incoming requests and routes them to the appropriate microservices for Budget Control. Budget Control Gateway does not properly validate auth tokens, which allows attackers to bypass intended restrictions. This vulnerability is fixed in 1.5.2.
Affected products
- BudgetControl Gateway: before 1.5.2 — fixed in 1.5.2
How to fix
Upgrade to a fixed version: BudgetControl Gateway 1.5.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2024-52528 or the next vulnerability affects your stack