PT-2019-19979 · Iodine · Iodine
Boaz Segev
·
Publicado
2019-10-07
·
Atualizado
2025-11-29
·
CVE-2024-22050
CVSS v3.1
7.5
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Iodine versions less than 0.7.33
Description
A path traversal issue in the static file service allows an unauthenticated, remote attacker to read files outside the public folder via malicious URLs. This can be achieved by drafting malicious URLs that cause the static file server to attempt a response containing data from files that shouldn't be normally accessible from the public folder.
Recommendations
For Iodine versions less than 0.7.33, upgrade to version 0.7.34 or later to resolve the issue.
As a temporary workaround, consider disabling the static file service and its
X-Sendfile support, and use an alternative method such as sending static files using nginx or a source code solution that sends the data dynamically.Exploit
Correção
Path traversal
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Iodine