CVE-2024-21518

Katalog CVE

CVSS 7.2 · High EPSS 14,1%

Kerentanan Path Traversal: '\..\filename' pada opencart. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

This affects versions of the package opencart/opencart from 4.0.0.0. A Zip Slip issue was identified via the marketplace installer due to improper sanitization of the target path, allowing files within a malicious archive to traverse the filesystem and be extracted to arbitrary locations. An attacker can create arbitrary files in the web root of the application and overwrite other existing files by exploiting this vulnerability.

Rincian

Terbit di NVD

22 Juni 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-29: Path Traversal: '\..\filename'
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-290: Authentication Bypass by Spoofing

EPSS (30 hari)

14,1% peluang dieksploitasi; lebih tinggi dari 96,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/opencart/opencart/blob/04c1724370ab02967d3b4f668c1b67771ecf1ff4/upload/admin/controller/mar... patch
• https://security.snyk.io/vuln/SNYK-PHP-OPENCARTOPENCART-7266578 exploit · advisory pihak ketiga