by Kastro
Paper/Archive/CVE-2024-2055

CVE-2024-2055

Artica Tech Artica Proxy — Artica Proxy Unauthenticated File Manager Vulnerability

EPSS 0.9%public exploitCVSS 9.8
critical.is priorityof 100
52
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 60.7.607 × 2012.1Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

The "Rich Filemanager" feature of Artica Proxy provides a web-based interface for file management capabilities. When the feature is enabled, it does not require authentication by default, and runs as the root user.

Affected

ProductAffectedFixed inSource
Artica Proxy4.50–CNA
Artica Proxy4.40–CNA
artica_proxy4.50–CISA-ADP
artica_proxy4.40–CISA-ADP

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

writeupkorelogic.com/Resources/Advisories/KL-001-2024-003.txtrefseclists.org/fulldisclosure/2024/Mar/13