CVE-2024-38358 — Katalog CVE

csirt@kutim:~/threat-intel/cve/CVE-2024-38358

CVSS 2.9 · Low EPSS 0,20%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). Skor CVSS 3.1 2.9 (Low) menurut github.com.

Deskripsi (NVD)

Wasmer is a web assembly (wasm) Runtime supporting WASIX, WASI and Emscripten. If the preopened directory has a symlink pointing outside, WASI programs can traverse the symlink and access host filesystem if the caller sets both `oflags::creat` and `rights::fd_write`. Programs can also crash the runtime by creating a symlink pointing outside with `path_symlink` and `path_open`ing the link. This issue has been addressed in commit `b9483d022` which has been included in release version 4.3.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Rincian

Terbit di NVD: 19 Juni 2024
Terakhir diubah: 17 Juni 2026
Status NVD: Deferred
CVSS 3.1: 2.9 (Low), sumber github.com
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
EPSS (30 hari): 0,20% peluang dieksploitasi; lebih tinggi dari 9,1% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.