CVE-2024-41922

{"id": "CVE-2024-41922", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "talos-cna@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2024-10-03T16:15:05.640", "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2061", "tags": ["Exploit", "Third Party Advisory"], "source": "talos-cna@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "talos-cna@cisco.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "A directory traversal vulnerability exists in the log files download functionality of Veertu Anka Build 1.42.0. A specially crafted HTTP request can result in a disclosure of arbitrary files. An attacker can make an unauthenticated HTTP request to trigger this vulnerability."}, {"lang": "es", "value": "Existe una vulnerabilidad de directory traversal en la funcionalidad de descarga de archivos de registro de Veertu Anka Build 1.42.0. Una solicitud HTTP especialmente manipulada puede dar como resultado la divulgaci\u00f3n de archivos arbitrarios. Un atacante puede realizar una solicitud HTTP no autenticada para activar esta vulnerabilidad."}], "lastModified": "2024-10-08T14:48:47.087", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:veertu:anka_build_cloud:1.42.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DA553BA9-4893-4500-B0FB-7ACF869B790A"}], "operator": "OR"}]}], "sourceIdentifier": "talos-cna@cisco.com"}