CVE-2017-18376

—

CVSS 3.0

8.8 high

EPSS

2%p78

Published

Jun 2, 2019 (Jun 2, 2019)

Modified

Jun 17, 2026

Description

An improper authorization check in the User API in TheHive before 2.13.4 and 3.x before 3.3.1 allows users with read-only or read/write access to escalate their privileges to the administrator's privileges. This affects app/controllers/UserCtrl.scala.

Vendors: strangebee
Products: thehive
Weakness: CWE-264
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.9%)

In the news0 stories

No ingested article mentions this CVE yet.