CVE-2025-24977: PYSEC-2025-179 - OpenCTI is an open cyber threat intelligence (CTI) platform. Prior to version 6.4.11 any user with…

CVE-2025-24977 · Severity: low · CVSS 3.1 · Published 2025-05-05

OpenCTI is an open cyber threat intelligence (CTI) platform. Prior to version 6.4.11 any user with the capability `manage customizations` can execute commands on the underlying infrastructure where OpenCTI is hosted and can access internal server side secrets by misusing the web-hooks. Since the malicious user gets a root shell inside a container this opens up the the infrastructure environment for further attacks and exposures. Version 6.4.11 fixes the issue.

Technologies: pycti (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2025-24977 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-24977 being exploited in the wild.
How severe is CVE-2025-24977?
Low severity, with a CVSS score of 3.1, published 5 May 2025.
Which products and versions are affected?
pycti (PyPI) ECOSYSTEM:introduced=6.4.8,fixed=6.4.11.
Is there a fix for CVE-2025-24977?
Yes. pycti (PyPI): upgrade to 6.4.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2025-24977?
Check whether you run pycti (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • pycti (PyPI): upgrade to 6.4.11 or later
    pip install "pycti>=6.4.11"

Affected products

  • pycti (PyPI) ECOSYSTEM:introduced=6.4.8,fixed=6.4.11

Identifiers

  • CVE-2025-24977
  • PYSEC-2025-179

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.