Yeti audit timeline API lacks authentication, exposing threat intelligence history
Anyone can read work logs in this analyst threat-data tool without logging in.
Summary
The audit timeline API in the Yeti threat intelligence platform has no authentication check, so an unauthenticated attacker can read analyst usernames and the change history of threat intelligence objects. Versions before 2.5.1 are affected.
What to do
Update to version 2.5.1 or later.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen