Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.1

TestLink TestPlan IDs can be accessed and modified by unauthorized users

CVE-2024-46097 · published 2 years ago
Summary

Unauthorized users can view and alter TestPlan IDs, potentially disrupting test management. This vulnerability affects TestLink version 1.9.20. To fix the issue, update to the latest version of TestLink.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
testlink testlink 1.9.20
cpe:2.3:a:testlink:testlink:1.9.20:*:*:*:*:*:*:*
Original advisory text
TestLink 1.9.20 is vulnerable to Incorrect Access Control in the TestPlan editing section. When a new TestPlan is created, an ID with an incremental value is automatically generated. Using the edit...
TestLink 1.9.20 is vulnerable to Incorrect Access Control in the TestPlan editing section. When a new TestPlan is created, an ID with an incremental value is automatically generated. Using the edit function you can change the tplan_id parameter to another ID. The application does not carry out a check on the user's permissions maing it possible to recover the IDs of all the TestPlans (even the administrative ones) and modify them even with minimal privileges.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.1 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-284Improper Access Control
Timeline
Published27 Sep 2024
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2024-46097 · NVD
Track software like this
Free during beta