CVE-2024-2318

Katalog CVE

CVSS 7.5 · High EPSS 0,93%

Kerentanan Relative Path Traversal pada zkteco zkbio media. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

A vulnerability was found in ZKTeco ZKBio Media 2.0.0_x64_2024-01-29-1028. It has been classified as problematic. Affected is an unknown function of the file /pro/common/download of the component Service Port 9999. The manipulation of the argument fileName with the input ../../../../zkbio_media.sql leads to path traversal: '../filedir'. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.1.3 Build 2025-05-26-1605 is able to address this issue. It is recommended to upgrade the affected component.

Rincian

Terbit di NVD

8 Maret 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-23: Relative Path Traversal
CWE-24: Path Traversal: '../filedir'
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,93% peluang dieksploitasi; lebih tinggi dari 59,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gist.github.com/whiteman007/a3b25a7ddf38774329d72930e0cd841a advisory pihak ketiga
• https://vuldb.com/?ctiid.256272 permissions required · vdb entry
• https://vuldb.com/?id.256272 permissions required · vdb entry
• https://vuldb.com/?submit.288530
• https://www.zkteco.com/en/Security_Bulletinsibs/11