PT-2024-21249 · Interaction Design Team At The University Of Applied Sciences Arts In Hildesheim/Germany+2 · Hawki

Florian Stuhlmann + 1 · Published 2024-05-29 · Updated 2024-07-03 · CVE-2024-25975

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions.

Description The issue concerns an application's up- and downvote function, which modifies a value in a JSON file. Due to improper filtering of POST parameters, an arbitrary file can be overwritten. An authenticated attacker can control the file but not its content. The vulnerability allows overwriting files that the webserver has write access to, requiring a relative path (path traversal) to be supplied.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-73

Related Identifiers

CVE-2024-25975

Affected Products

Hawki

References · 7

• https://github.com/HAWK-Digital-Environments/HAWKI/commit/146967f3148e92d1640ffebc21d8914e2d7fb3f1 · Patch
• https://osv.dev/vulnerability/CVE-2024-25975 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-25975 · Security Note
• https://t.me/cvenotify/81399 · Telegram Post
• http://seclists.org/fulldisclosure/2024/May/34 · Note
• https://t.me/cvenotify/81374 · Telegram Post
• https://r.sec-consult.com/hawki · Note