CVE-2024-39688

{"id": "CVE-2024-39688", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "published": "2024-07-22T16:15:03.883", "references": [{"url": "https://github.com/fishaudio/Bert-VITS2/blob/76653b5b6d657143721df2ed6c5c246b4b1d9277/webui_preprocess.py#L130-L133", "tags": ["Issue Tracking"], "source": "security-advisories@github.com"}, {"url": "https://github.com/fishaudio/Bert-VITS2/blob/76653b5b6d657143721df2ed6c5c246b4b1d9277/webui_preprocess.py#L34", "tags": ["Issue Tracking"], "source": "security-advisories@github.com"}, {"url": "https://securitylab.github.com/advisories/GHSL-2024-045_GHSL-2024-047_fishaudio_Bert-VITS2/", "tags": ["Exploit", "Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}, {"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Bert-VITS2 is the VITS2 Backbone with multilingual bert. User input supplied to the data_dir variable is concatenated with other folders and used to open a new file in the generate_config function, which leads to a limited file write. The issue allows for writing /config/config.json file in arbitrary directory on the server. If a given directory path doesn\u2019t exist, the application will return an error, so this vulnerability could also be used to gain information about existing directories on the server. This affects fishaudio/Bert-VITS2 2.3 and earlier."}, {"lang": "es", "value": "Bert-VITS2 es la columna vertebral de VITS2 con bert multiling\u00fce. La entrada del usuario proporcionada a la variable data_dir se concatena con otras carpetas y se usa para abrir un nuevo archivo en la funci\u00f3n generate_config, lo que conduce a una escritura de archivo limitada. El problema permite escribir el archivo /config/config.json en un directorio arbitrario del servidor. Si una ruta de directorio determinada no existe, la aplicaci\u00f3n devolver\u00e1 un error, por lo que esta vulnerabilidad tambi\u00e9n podr\u00eda usarse para obtener informaci\u00f3n sobre directorios existentes en el servidor. Esto afecta a fishaudio/Bert-VITS2 2.3 y versiones anteriores."}], "lastModified": "2024-09-11T15:41:17.747", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fish.audio:bert-vits2:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EEF91E74-C0D0-413F-877E-10BB631A31E9", "versionEndIncluding": "2.3"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}