CVE-2024-58396
CVE-2024-58396 · YouDataSum CPAS Audit Management System V4 Path Traversal via downPlugs fileId
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
YouDataSum CPAS Audit Management System V4 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the fileId parameter. Attackers can send GET requests to /cpasm4/plugInManController/downPlugs with ../ sequences in fileId to retrieve system files like /etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-01-13.
CVSS 8.7 · Alta · EPSS 0,5%
- Publicación
- Actualización
Productos y versiones afectados
cpas audit management system
- Versiones
- V4: Afectada (custom)
Sin corrección publicada
Fuentes originales
- https://github.com/gelusus/wxvl/blob/main/doc/2024-12/%E3%80%8C%E6%BC%8F%E6%B4%9E%E5%A4%8D%E7%8E%B0%E3%80%8D%E5%8F%8B%E6%95%B0%E8%81%9A%20CPAS%E5%AE%A1%E8%AE%A1%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9FV4%20downPlugs%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md
- https://github.com/eeeeeeeeee-code/POC/blob/main/wpoc/%E5%8C%97%E4%BA%AC%E5%8F%8B%E6%95%B0%E8%81%9A%E7%A7%91%E6%8A%80/CPAS%E5%AE%A1%E8%AE%A1%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F%E5%AD%98%E5%9C%A8%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/cpas-managment-lfi.yaml
- https://www.youdatasum.com/
- https://www.vulncheck.com/advisories/youdatasum-cpas-audit-management-system-v4-path-traversal-via-downplugs-fileid
- https://nvd.nist.gov/vuln/detail/CVE-2024-58396