{"metadata": {"vulnerability": "GHSA-794X-GM8V-2WJ6", "count": 8, "kinds": {"milestone": 2, "sighting": 2, "kev": 0, "other": 4}}, "data": [{"timestamp": "2024-12-09T14:22:52.524Z", "date_only": false, "value": "2024-12-09T14:22:52.524Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5 \u00b7 CVE-2024-55604", "record": "CVE-2024-55604", "field": "cveMetadata.dateReserved"}, {"timestamp": "2025-03-25T14:15:05.339Z", "date_only": false, "value": "2025-03-25T14:15:05.339Z", "kind": "milestone", "label": "Published", "source": "cvelistv5 \u00b7 CVE-2024-55604", "record": "CVE-2024-55604", "field": "cveMetadata.datePublished"}, {"timestamp": "2025-03-25T14:15:05.339Z", "date_only": false, "value": "2025-03-25T14:15:05.339Z", "kind": "other", "label": "Updated", "source": "cvelistv5 \u00b7 CVE-2024-55604 / GitHub_M", "record": "CVE-2024-55604", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2025-03-25T14:24:13Z", "date_only": false, "value": "2025-03-25T14:24:13.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/8662", "record": "GHSA-794X-GM8V-2WJ6", "field": "creation_timestamp", "uuid": "ea2948dd-dcda-4e91-bf61-28b13142b9ae", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-55604\n\ud83d\udd25 CVSS Score: 4.8 (cvssV4_0, Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N)\n\ud83d\udd39 Description: Appsmith is a platform to build admin panels, internal tools, and dashboards. Users invited as \"App Viewer\" should not have access to development information of a workspace. Datasources are such a component in a workspace. Yet, in versions of Appsmith prior to 1.51, app viewers are able to get a list of datasources in a workspace they're a member of. This information disclosure does NOT expose sensitive data in the datasources, such as database passwords and API Keys. The attacker needs to have been invited to a workspace as a \"viewer\", by someone in that workspace with access to invite. The attacker then needs to be able to signup/login to that Appsmith instance. The issue is patched in version 1.51. No known workarounds are available.\n\ud83d\udccf Published: 2025-03-25T14:15:05.339Z\n\ud83d\udccf Modified: 2025-03-25T14:15:05.339Z\n\ud83d\udd17 References:\n1. https://github.com/appsmithorg/appsmith/security/advisories/GHSA-794x-gm8v-2wj6", "url": "https://t.me/DarkWebInformer_CVEAlerts/8662"}, {"timestamp": "2025-03-25T14:44:30.776Z", "date_only": false, "value": "2025-03-25T14:44:30.776825Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 \u00b7 CVE-2024-55604 / CISA-ADP", "record": "CVE-2024-55604", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2025-03-25T14:44:39.532Z", "date_only": false, "value": "2025-03-25T14:44:39.532Z", "kind": "other", "label": "Updated", "source": "cvelistv5 \u00b7 CVE-2024-55604", "record": "CVE-2024-55604", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2025-03-25T14:44:39.532Z", "date_only": false, "value": "2025-03-25T14:44:39.532Z", "kind": "other", "label": "Updated", "source": "cvelistv5 \u00b7 CVE-2024-55604 / CISA-ADP", "record": "CVE-2024-55604", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2025-03-26T20:25:48Z", "date_only": false, "value": "2025-03-26T20:25:48.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/8959", "record": "GHSA-794X-GM8V-2WJ6", "field": "creation_timestamp", "uuid": "18c15707-1ddf-4eba-90a4-61340d00fcc7", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-55965\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: An issue was discovered in Appsmith before 1.51. Users invited as \"App Viewer\" incorrectly have access to development information of a workspace (specifically, a list of datasources in a workspace they're a member of). This information disclosure does not expose sensitive data in the datasources, such as database passwords and API Keys.\n\ud83d\udccf Published: 2025-03-26T00:00:00.000Z\n\ud83d\udccf Modified: 2025-03-26T20:12:18.796Z\n\ud83d\udd17 References:\n1. https://github.com/appsmithorg/appsmith/security/advisories/GHSA-794x-gm8v-2wj6", "url": "https://t.me/DarkWebInformer_CVEAlerts/8959"}]}