PT-2024-22894 · Alldata · Alldata

Raybye · Published 2024-04-02 · Updated 2024-04-03 · CVE-2024-29434

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Alldata version 0.4.6

Description The issue in the system image upload interface allows attackers to execute a directory traversal when uploading a file. This enables them to access or modify files outside the intended directory, potentially leading to unauthorized data access or system compromise.

Recommendations For Alldata version 0.4.6, consider restricting access to the system image upload interface until a patch is available. As a temporary workaround, avoid using the file upload feature to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-29434

Affected Products

Alldata

References · 6

• https://osv.dev/vulnerability/CVE-2024-29434 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-29434 · Security Note
• https://t.me/cvenotify/75562 · Telegram Post
• https://twitter.com/CVEnew/status/1775273328992997627 · Twitter Post
• ❌ https://github.com/Raybye/alldata-bug/blob/main/alldata.md · Note, Deleted
• https://gist.github.com/Raybye/6cf4aa273e12a220056e38bec764d42d · Note