PT-2024-29470 · Severalnines · Severalnines Clustercontrol

Published 2024-07-26 · Updated 2024-08-06 · CVE-2024-41628

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Severalnines Cluster Control versions 1.9.8 through 1.9.8-9777 Severalnines Cluster Control versions 2.0.0 through 2.0.0-9778 Severalnines Cluster Control versions 2.1.0 through 2.1.0-9779

Description A Directory Traversal issue allows a remote attacker to include and display file content in an HTTP request via the CMON API.

Recommendations For Severalnines Cluster Control version 1.9.8, update to version 1.9.8-9778 or later. For Severalnines Cluster Control version 2.0.0, update to version 2.0.0-9779 or later. For Severalnines Cluster Control version 2.1.0, update to version 2.1.0-9780 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-41628

Affected Products

Severalnines Clustercontrol

References · 7

• 🔥 https://github.com/Redshift-CyberSecurity/CVE-2024-41628 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-41628 · Security Note
• https://docs.severalnines.com/docs/clustercontrol/changelogs/changes-in-v1-9-8/#maintenance-release-july-24th-2024 · Note
• http://severalnines.com · Note
• http://clustercontrol.com · Note
• https://docs.severalnines.com/docs/clustercontrol/changelogs/changes-in-v2-1-0 · Note
• https://t.me/cvedetector/1723 · Telegram Post