PT-2024-22959 · Unknown · Zly2006 Reden

Apple502J · Published 2024-04-04 · Updated 2024-08-16 · CVE-2024-29672

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:R

Name of the Vulnerable Software and Affected Versions zly2006 Reden versions prior to 0.2.514

Description A Directory Traversal issue allows a remote attacker to execute arbitrary code via the DEBUG RTC REQUEST SYNC DATA in KeyCallbacks.kt. This enables the attacker to potentially access and manipulate sensitive data.

Recommendations For versions prior to 0.2.514, update to version 0.2.514 or later to resolve the issue. As a temporary workaround, consider restricting access to the DEBUG RTC REQUEST SYNC DATA in KeyCallbacks.kt to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-29672

Affected Products

Zly2006 Reden

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-29672 · Security Note
• https://osv.dev/vulnerability/CVE-2024-29672 · Vendor Advisory
• https://github.com/zly2006/reden-is-what-we-made/commit/44c5320f0a1ccaa764dd91df6a12e747f81fe63a · Note
• https://gist.github.com/apple502j/193358682885fe1a6708309ce934e4ed · Note
• https://twitter.com/cracbot/status/1776506067305787574 · Twitter Post
• https://t.me/cvenotify/75804 · Telegram Post
• https://t.me/cvenotify/90918 · Telegram Post
• https://twitter.com/CVEnew/status/1776125710358200729 · Twitter Post