Medium severity · published Sep 17, 2024
CVE-2024-45816
Backstage is an open framework for building developer portals
6.5
CVSS
0.7%
EPSS
No
On KEV
Description
Backstage is an open framework for building developer portals. When using the AWS S3 or GCS storage provider for TechDocs it is possible to access content in the entire storage bucket. This can leak contents of the bucket that are not intended to be accessible, as well as bypass permission checks in Backstage. This has been fixed in the 1.10.13 release of the `@backstage/plugin-techdocs-backend` package. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BA
Backstage · Linuxfoundation
before 1.10.13 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-45816
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-45816
Third Party Advisory
https://github.com/backstage/backstage/security/advisories/GHSA-39v3-f278-vj3g
More from Backstage
9.9
CVE-2026-106486
Backstage: Improper filesystem validation in Bitbucket pull-request scaffolder actions
9.9
CVE-2023-35926
Backstage is an open platform for building developer portals
9.6
CVE-2026-106501
Backstage: Sensitive information exposure in Scaffolder
8.8
CVE-2026-106558
Backstage: Improper validation of TechDocs MkDocs configuration
8.8
CVE-2026-106509
Backstage: Improper validation of MkDocs theme configuration in TechDocs