PT-2024-16848 · Landray · Landray Ekp

Coinismoney · Published 2024-11-15 · Updated 2024-11-19 · CVE-2024-11239

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Landray EKP versions up to 16.0

Description A critical vulnerability has been found in Landray EKP, affecting the deleteFile function of the file /sys/common/import.do?method=deleteFile in the API Interface component. The manipulation of the folder argument leads to path traversal. This issue can be initiated remotely. The vendor was contacted about this disclosure but did not respond.

Recommendations For Landray EKP versions up to 16.0, update to the latest patch immediately to mitigate risks. As a temporary workaround, consider restricting access to the /sys/common/import.do?method=deleteFile endpoint until a patch is available. Avoid using the folder argument in the affected API endpoint until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-11239

Affected Products

Landray Ekp

References · 13

• 🔥 https://github.com/CoinIsMoney/TempGuide/blob/main/LL-exp-03.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-11239 · Security Note
• https://osv.dev/vulnerability/CVE-2024-11239 · Vendor Advisory
• https://vuldb.com/?submit.438784 · Note
• https://vuldb.com/?id.284674 · Note
• https://t.me/cvenotify/101820 · Telegram Post
• https://twitter.com/transilienceai/status/1858017194828845089 · Twitter Post
• https://vuldb.com/?ctiid.284674 · Note
• https://twitter.com/transilienceai/status/1858017189372043445 · Twitter Post
• https://twitter.com/CVEnew/status/1857421202907885619 · Twitter Post
• https://t.me/cvedetector/11078 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1857458600207118627 · Twitter Post
• https://t.me/cvenotify/102189 · Telegram Post