Is CVE-2024-46097 actively exploited?

No active exploitation of CVE-2024-46097 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2024-46097 be exploited remotely?

Yes. CVE-2024-46097 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2024-46097?

CVE-2024-46097 has a CVSS score of 8.1 (HIGH).

HOME VULNERABILITIESCVE-2024-46097

HIGH

CVE-2024-46097

CWE-284Published: September 27, 2024· Updated: Jun 17, 2026

8.1

CVSS v3.1

Official Description

TestLink 1.9.20 is vulnerable to Incorrect Access Control in the TestPlan editing section. When a new TestPlan is created, an ID with an incremental value is automatically generated. Using the edit function you can change the tplan_id parameter to another ID. The application does not carry out a check on the user's permissions maing it possible to recover the IDs of all the TestPlans (even the administrative ones) and modify them even with minimal privileges.

NVD Source

Technical Analysis

CVE-2024-46097 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), with a CVSS base score of 8.1.