Threat Investigation
Request a demo

CVE-2025-24977

Critical

Description

OpenCTI is an open cyber threat intelligence (CTI) platform. Prior to version 6.4.11 any user with the capability `manage customizations` can execute commands on the underlying infrastructure where OpenCTI is hosted and can access internal server side secrets by misusing the web-hooks. Since the malicious user gets a root shell inside a container this opens up the the infrastructure environment for further attacks and exposures. Version 6.4.11 fixes the issue.

SeverityCritical
CVSS9.1
Exploit probability—
ProductCiteum Opencti
PublishedMay 5, 2025
First seenMay 5, 2025
Weakness typeCWE-94Code injection

How to fix

Update
  • citeum opencti6.4.11 or later
  • pycti6.4.11 or later

Affected products

ProductAffected versionsFixed in
citeum opencti6.4.8 ≤ v < 6.4.116.4.11
pyctiPyPI6.4.8 ≤ v < 6.4.116.4.11

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.