PT-2024-12054 · Unknown · Ladle Dev Server

Published 2024-03-28 · Updated 2024-04-05 · CVE-2023-25341

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ladle Dev Server versions 2.5.1 and earlier

Description A Directory Traversal issue allows an attacker on the same network to read files accessible to the user via GET requests. This can be exploited by sending requests to specific API endpoints, although the exact endpoints are not specified. The issue affects users on the local network, potentially allowing access to sensitive files.

Recommendations For Ladle Dev Server versions 2.5.1 and earlier, restrict access to trusted users or apply a patch as soon as possible to mitigate the risk of exploitation. As a temporary workaround, consider restricting access to sensitive files and directories until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2023-25341

Affected Products

Ladle Dev Server

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-25341 · Security Note
• https://t.me/cvenotify/75057 · Telegram Post
• https://twitter.com/oktsec/status/1776294186494374167 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1773509985139319101 · Twitter Post
• https://runjak.codes/posts/2024-03-21-ladle-cve · Note
• https://twitter.com/CVEnew/status/1773461410238107712 · Twitter Post
• https://t.me/cvenotify/75107 · Telegram Post