CVE-2024-7738

Katalog CVE

CVSS 7.8 · High EPSS 0,30%

Kerentanan DEPRECATED: Pathname Traversal and Equivalence Errors pada yzane markdown pdf. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

A vulnerability, which was classified as problematic, has been found in yzane vscode-markdown-pdf 1.5.0. Affected by this issue is some unknown functionality of the component Markdown File Handler. The manipulation leads to pathname traversal. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.

Rincian

Terbit di NVD

13 Agustus 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-21: DEPRECATED: Pathname Traversal and Equivalence Errors
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,30% peluang dieksploitasi; lebih tinggi dari 21,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://vuldb.com/?id.274358 advisory pihak ketiga
• https://vuldb.com/?submit.385634 advisory pihak ketiga
• https://github.com/abhi-ingle/Vulnerability-Research/blob/main/POC/Arbitrary%20File%20Read/file_read_report.md broken link
• https://github.com/abhi-ingle/Vulnerability-Research/blob/main/POC/Arbitrary%20File%20Read/poc_arbitrary_file_... broken link
• https://vuldb.com/?ctiid.274358 permissions required