CVE-2024-48914

Katalog CVE KUTIM-CSIRT

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2024-48914

Katalog CVE

CVSS 9.1 · Critical EPSS 60,4%

Kerentanan Improper Input Validation. Skor CVSS 3.1 9.1 (Critical) menurut github.com.

Deskripsi (NVD)

Vendure is an open-source headless commerce platform. Prior to versions 3.0.5 and 2.3.3, a vulnerability in Vendure's asset server plugin allows an attacker to craft a request which is able to traverse the server file system and retrieve the contents of arbitrary files, including sensitive data such as configuration files, environment variables, and other critical data stored on the server. In the same code path is an additional vector for crashing the server via a malformed URI. Patches are available in versions 3.0.5 and 2.3.3. Some workarounds are also available. One may use object storage rather than the local file system, e.g. MinIO or S3, or define middleware which detects and blocks requests with urls containing `/../`.

Rincian

Terbit di NVD
15 Oktober 2024
Terakhir diubah
17 Juni 2026
Status NVD
Deferred
CVSS 3.1
9.1 (Critical), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-20: Improper Input Validation
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
EPSS (30 hari)
60,4% peluang dieksploitasi; lebih tinggi dari 99,1% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.