CVE-2024-22232

{"id": "CVE-2024-22232", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security@vmware.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 3.1}]}, "published": "2024-06-27T07:15:54.227", "references": [{"url": "https://saltproject.io/security-announcements/2024-01-31-advisory/", "source": "security@vmware.com"}, {"url": "https://saltproject.io/security-announcements/2024-01-31-advisory/", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "A specially crafted url can be created which leads to a directory traversal in the salt file server.\nA malicious user can read an arbitrary file from a Salt master\u2019s filesystem."}, {"lang": "es", "value": "Se puede crear una URL especialmente manipulada que conduzca a directory traversal en el servidor de archivos salt. Un usuario malintencionado puede leer un archivo arbitrario del sistema de archivos de un maestro Salt."}], "lastModified": "2024-11-21T08:55:51.217", "sourceIdentifier": "security@vmware.com"}