by Kastro
Paper/Archive/CVE-2024-23822

CVE-2024-23822

sni Thruk — Thruk Incorrect limitation of a pathname to a restricted directory (Path Traversal) (CWE-22)

EPSS 1%public exploitCVSS 9.8
critical.is priorityof 100
54
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 73.1.731 × 2014.6Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Thruk is a multibackend monitoring webinterface. Prior to 3.12, the Thruk web monitoring application presents a vulnerability in a file upload form that allows a threat actor to arbitrarily upload files to the server to any path they desire and have permissions for. This vulnerability is known as Path Traversal or Directory Traversal. Version 3.12 fixes the issue.

Affected

ProductAffectedFixed inSource
Thruk< 3.12–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub_M (CNA)5.4CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: partial

References

refgithub.com/sni/Thruk/security/advisories/GHSA-4mrh-mx7x-rqjxrefgithub.com/sni/Thruk/commit/1aa9597cdf2722a69651124f68cbb449be12cc39