PT-2024-30265 · Fonoster · Fonoster

Published 2024-08-23 · Updated 2026-03-09 · CVE-2024-43035

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Fonoster (affected versions not specified)

Description A Local File Inclusion issue has been identified in Fonoster. A Proof of Concept (PoC) script is available, demonstrating the vulnerability. This issue allows for the inclusion of local files, potentially leading to sensitive information disclosure or other security issues.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-24

Related Identifiers

CVE-2024-43035

GHSA-9FV2-C7V6-P45W

Affected Products

Fonoster

References · 10

• https://osv.dev/vulnerability/CVE-2024-43035 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9fv2-c7v6-p45w · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-43035 · Security Note
• https://github.com/fonoster/fonoster · Note
• https://github.com/fonoster/fonoster/blob/4a1438d9dedeaf7b2a5b6a50d5e233f994e2b2cf/mods/voice/src/utils.ts#L66-L70 · Note
• https://twitter.com/VulmonFeeds/status/1827107507610746982 · Twitter Post
• https://twitter.com/infoflowcloud/status/2030756930512171126 · Twitter Post
• https://twitter.com/CVEnew/status/2030755430239010885 · Twitter Post
• https://t.me/cveNotify/154786 · Telegram Post
• https://zeropath.com/blog/fonoster-voiceserver-lfi-vulnerability · Note