PT-2024-28009 · Kasmvnc · Kasmvnc

D0Td0Tslash · Published 2024-06-17 · Updated 2024-11-06 · CVE-2024-38449

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions KasmVNC versions 1.3.1.230e50f7b89663316c70de7b0e3db6f6b9340489 and earlier

Description A Directory Traversal issue allows remote authenticated attackers to browse parent directories and read the content of files outside the scope of the application.

Recommendations For KasmVNC version 1.3.1.230e50f7b89663316c70de7b0e3db6f6b9340489 and earlier, at the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-38449

Affected Products

Kasmvnc

References · 5

• https://osv.dev/vulnerability/CVE-2024-38449 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-38449 · Security Note
• https://github.com/kasmtech/KasmVNC/issues/254 · Note
• https://kasmweb.com/kasmvnc · Note
• https://kasmweb.atlassian.net/servicedesk/customer/portal/3/topic/30ffee7f-4b85-4783-b118-6ae4fd8b0c52 · Note