PT-2024-28744 · Supos · Supos

Published 2024-07-04 · Updated 2025-11-10 · CVE-2024-39937

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AC:L/AV:N/A:N/C:H/I:N/PR:N/S:C/UI:N

Name of the Vulnerable Software and Affected Versions supOS version 5.0

Description The issue allows directory traversal for reading files via the "api/image/download" endpoint, specifically when the fileName parameter contains ../. This enables unauthorized access to files on the system.

Recommendations For supOS version 5.0, as a temporary workaround, consider restricting access to the "api/image/download" endpoint until a patch is available. Additionally, avoid using the fileName parameter with ../ in the affected endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-39937

Affected Products

Supos

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2024-39937 · Security Note
• https://osv.dev/vulnerability/CVE-2024-39937 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1809026629282185509 · Twitter Post
• https://t.me/cvedetector/73 · Telegram Post
• https://cloud.supos.com/announcement/detail?id=1985637965817671680 · Note
• https://twitter.com/CveFindCom/status/1808977122058285150 · Twitter Post
• https://t.me/cvenotify/85187 · Telegram Post
• https://t.me/cveNotify/142297 · Telegram Post
• ❌ https://github.com/bytehunter-rat/supOS-BUG/blob/main/supOSDirectoryTraversal.md · Note, Deleted
• https://twitter.com/cracbot/status/1810554540749722002 · Twitter Post
• https://twitter.com/CVEnew/status/1808978812333437031 · Twitter Post
• https://supos.com/supOSindex · Note
• https://twitter.com/cracbot/status/1810192187118035271 · Twitter Post