Vulnerability feed

Executive summary

A flaw has been found in OpenBB, an investment research platform from openbq-org, affecting versions up to 4.7.2 and 5.0.0. The advisory says a public exploit has been published and may be used, and it notes the vendor did not respond to early disclosure. The advisory does not state a severity score or a fix.

Technical summary

The weakness is classified as improper access controls in the Local API Server component, specifically in the file openbb_platform/core/openbb_core/app/model/api_settings.py. The advisory states remote exploitation is possible and that a published exploit may be used. Affected versions are stated as up to 4.7.2/5.0.0, and no fixed version is stated. No workaround is stated, no CVSS score is stated, and no detection guidance is stated. The vendor did not respond to early disclosure, so no vendor patch or guidance is referenced.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Attack requirements

None

Privileges required

None

User interaction

Passive

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affects

openbq-orgopenbq-org OpenBB