CVE-2024-12362: invoiceplane

csirt@kutim:~/threat-intel/cve/CVE-2024-12362

CVSS 4.3 · Medium EPSS 0,56%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada invoiceplane. Skor CVSS 3.1 4.3 (Medium) menurut vuldb.com.

Deskripsi (NVD)

A vulnerability was found in InvoicePlane up to 1.6.1. It has been classified as problematic. This affects the function download of the file invoices.php. The manipulation of the argument invoice leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.6.2-beta-1 is able to address this issue. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Rincian

Terbit di NVD: 16 Desember 2024
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 4.3 (Medium), sumber vuldb.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
EPSS (30 hari): 0,56% peluang dieksploitasi; lebih tinggi dari 44,9% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
invoiceplane	invoiceplane	Semua versi hingga 1.6.1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://vuldb.com/?id.288537 advisory pihak ketiga · vdb entry
https://vuldb.com/?submit.459908 advisory pihak ketiga · vdb entry
https://github.com/InvoicePlane/InvoicePlane/pull/1127 issue tracking
https://github.com/InvoicePlane/InvoicePlane/releases/tag/v1.6.2-beta-1 release notes
https://vuldb.com/?ctiid.288537 permissions required · vdb entry

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.