PT-2024-26887 · Vaultize · Vaultize

Published 2024-05-24 · Updated 2024-08-20 · CVE-2024-36079

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Vaultize version 21.07.27

Description An issue was discovered in the software where there is no check that the filename parameter is correct when uploading files. As a result, a temporary file will be created outside the specified directory when the file is downloaded. To exploit this, an authenticated user would upload a file with an incorrect file name, and then download it.

Recommendations For Vaultize version 21.07.27, consider implementing a check for the filename parameter to ensure it is correct before allowing file uploads and downloads. As a temporary workaround, restrict access to file upload and download functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-36079

Affected Products

Vaultize

References · 5

• 🔥 https://github.com/DxRvs/vaultize_CVE-2024-36079 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-36079 · Security Note
• https://t.me/cvenotify/91289 · Telegram Post
• https://t.me/cvenotify/81011 · Telegram Post
• https://t.me/cvenotify/81132 · Telegram Post