PT-2024-31792 · Vite · Vite

Adi1 · Published 2024-09-17 · Updated 2025-01-17 · CVE-2024-45811

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Vite versions prior to 3.2.11 Vite versions prior to 4.5.5 Vite versions prior to 5.2.14 Vite versions prior to 5.3.6 Vite versions prior to 5.4.6

Description: The contents of arbitrary files can be returned to the browser. @fs denies access to files outside of Vite serving allow list. Adding ?import&raw to the URL bypasses this limitation and returns the file content if it exists.

Recommendations: For versions prior to 3.2.11, upgrade to version 3.2.11 or later. For versions prior to 4.5.5, upgrade to version 4.5.5 or later. For versions prior to 5.2.14, upgrade to version 5.2.14 or later. For versions prior to 5.3.6, upgrade to version 5.3.6 or later. For versions prior to 5.4.6, upgrade to version 5.4.6 or later. As a temporary workaround, consider restricting access to the @fs module until a patch is available. Avoid using the ?import&raw parameter in the affected URL until the issue is resolved.

Exploit

Fix

Information Disclosure

Improper Access Control

Weakness Enumeration

CWE-200

CWE-284

Related Identifiers

CVE-2024-45811

GHSA-9CWX-2883-4WFX

OPENSUSE-SU-2025:14663-1

Affected Products

Vite

References · 43

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45811.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-45811 · Security Note
• https://osv.dev/vulnerability/CVE-2024-45811 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9cwx-2883-4wfx · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:14663-1 · Vendor Advisory
• https://github.com/vitejs/vite · Note
• https://github.com/vitejs/vite/commit/4573a6fd6f1b097fb7296a3e135e0646b996b249 · Note
• https://github.com/vitejs/vite/commit/b901438f99e667f76662840826eec91c8ab3b3e7 · Note
• https://github.com/vitejs/vite/commit/8339d7408668686bae56eaccbfdc7b87612904bd · Note
• https://github.com/vitejs/vite/commit/a6da45082b6e73ddfdcdcc06bb5414f976a388d6 · Note
• https://github.com/vitejs/vite/security/advisories/GHSA-9cwx-2883-4wfx · Note
• https://github.com/vitejs/vite/commit/6820bb3b9a54334f3268fc5ee1e967d2e1c0db34 · Note
• https://suse.com/security/cve/CVE-2024-37298 · Note
• https://suse.com/security/cve/CVE-2024-4067 · Note
• https://suse.com/security/cve/CVE-2024-24786 · Note