org.bonitasoft.engine vulnerabilities

Products

• org.bonitasoft.engine/bonita-server 1

Latest org.bonitasoft.engine CVEs

Newest publication first

1. CVE-2024-28087 Bonitasoft Runtime Community edition's contains an insecure direct object references vulnerability

   Published 2024-05-15

   Medium·CVSS 6.5 EPSS 0.32%

   In Bonitasoft runtime Community edition, the lack of dynamic permissions causes IDOR vulnerability. Dynamic permissions existed only in Subscription edition and have now been restored in Community edition, where they are not custmizable.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.