CVE-2024-46898

SHIRASAGI prior to v1.19.1 processes URLs in HTTP requests improperly, resulting in a path traversal vulnerability. If this vulnerability is exploited, arbitrary files on the server may be retrieved when processing crafted HTTP requests.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/shirasagi/shirasagi/commit/5ac4685d7e4330f949f13219069107fc5d768934	Patch
https://jvn.jp/en/jp/JVN58721679/	Third Party Advisory
https://www.ss-proj.org/	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:ss-proj:shirasagi:*:*:*:*:*:*:*:*

History

17 Oct 2024, 17:52

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~8.6~~	v2 : unknown v3 : 7.5
First Time		Ss-proj shirasagi Ss-proj
CPE		cpe:2.3:a:ss-proj:shirasagi::::::::
References	~~() https://github.com/shirasagi/shirasagi/commit/5ac4685d7e4330f949f13219069107fc5d768934 -~~	() https://github.com/shirasagi/shirasagi/commit/5ac4685d7e4330f949f13219069107fc5d768934 - Patch
References	~~() https://jvn.jp/en/jp/JVN58721679/ -~~	() https://jvn.jp/en/jp/JVN58721679/ - Third Party Advisory
References	~~() https://www.ss-proj.org/ -~~	() https://www.ss-proj.org/ - Product

15 Oct 2024, 12:57

Type	Values Removed	Values Added
Summary		(es) Las versiones anteriores a la v1.19.1 de SHIRASAGI procesan las URL de las solicitudes HTTP de forma incorrecta, lo que genera una vulnerabilidad de path traversal. Si se explota esta vulnerabilidad, se pueden recuperar archivos arbitrarios del servidor al procesar solicitudes HTTP manipuladas.

15 Oct 2024, 07:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-10-15 07:15

Updated : 2024-10-17 17:52

NVD link : CVE-2024-46898

Mitre link : CVE-2024-46898

CVE.ORG link : CVE-2024-46898

JSON object : View

Products Affected

ss-proj

shirasagi

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2024-46898", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "vultures@jpcert.or.jp", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 3.9}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2024-10-15T07:15:02.267", "references": [{"url": "https://github.com/shirasagi/shirasagi/commit/5ac4685d7e4330f949f13219069107fc5d768934", "tags": ["Patch"], "source": "vultures@jpcert.or.jp"}, {"url": "https://jvn.jp/en/jp/JVN58721679/", "tags": ["Third Party Advisory"], "source": "vultures@jpcert.or.jp"}, {"url": "https://www.ss-proj.org/", "tags": ["Product"], "source": "vultures@jpcert.or.jp"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}, {"type": "Secondary", "source": "vultures@jpcert.or.jp", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "SHIRASAGI prior to v1.19.1 processes URLs in HTTP requests improperly, resulting in a path traversal vulnerability. If this vulnerability is exploited, arbitrary files on the server may be retrieved when processing crafted HTTP requests."}, {"lang": "es", "value": "Las versiones anteriores a la v1.19.1 de SHIRASAGI procesan las URL de las solicitudes HTTP de forma incorrecta, lo que genera una vulnerabilidad de path traversal. Si se explota esta vulnerabilidad, se pueden recuperar archivos arbitrarios del servidor al procesar solicitudes HTTP manipuladas."}], "lastModified": "2024-10-17T17:52:00.700", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ss-proj:shirasagi:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "66E31BF1-0924-4BED-8A2E-19B101B7DC87", "versionEndExcluding": "1.19.1"}], "operator": "OR"}]}], "sourceIdentifier": "vultures@jpcert.or.jp"}