CVE-2024-3829

Katalog CVE

CVSS 9.1 · Critical EPSS 0,91%

Kerentanan Improper Link Resolution Before File Access ('Link Following') pada qdrant. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

qdrant/qdrant version 1.9.0-dev is vulnerable to arbitrary file read and write during the snapshot recovery process. Attackers can exploit this vulnerability by manipulating snapshot files to include symlinks, leading to arbitrary file read by adding a symlink that points to a desired file on the filesystem and arbitrary file write by including a symlink and a payload file in the snapshot's directory structure. This vulnerability allows for the reading and writing of arbitrary files on the server, which could potentially lead to a full takeover of the system. The issue is fixed in version v1.9.0.

Rincian

Terbit di NVD

3 Juni 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-59: Improper Link Resolution Before File Access ('Link Following')

EPSS (30 hari)

0,91% peluang dieksploitasi; lebih tinggi dari 58,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/qdrant/qdrant/commit/ee7a31ec3459a6a4219200234615c1817ab82260 patch
• https://huntr.com/bounties/abd9c906-75ee-4d84-b76d-ce1386401e08 exploit · advisory pihak ketiga