CVE-2024-6746

Katalog CVE

CVSS 8.8 · High EPSS 3,3%

Kerentanan Path Traversal: '../filedir' pada easyspider. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

A vulnerability classified as problematic was found in NaiboWang EasySpider 0.6.2 on Windows. Affected by this vulnerability is an unknown functionality of the file \EasySpider\resources\app\server.js of the component HTTP GET Request Handler. The manipulation with the input /../../../../../../../../../Windows/win.ini leads to path traversal: '../filedir'. The attack needs to be done within the local network. The exploit has been disclosed to the public and may be used. The identifier VDB-271477 was assigned to this vulnerability. NOTE: The code maintainer explains, that this is not a big issue "because the default is that the software runs locally without going through the Internet".

Rincian

Terbit di NVD

15 Juli 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-24: Path Traversal: '../filedir'
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

3,3% peluang dieksploitasi; lebih tinggi dari 88,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://vuldb.com/?id.271477 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.371998 advisory pihak ketiga · vdb entry
• https://github.com/NaiboWang/EasySpider/issues/466 exploit · issue tracking
• https://vuldb.com/?ctiid.271477 permissions required