PT-2024-32270 · Shirasagi · Shirasagi

Shogo Kumamaru · Published 2024-10-14 · Updated 2024-10-19 · CVE-2024-46898

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SHIRASAGI versions prior to 1.19.1

Description The issue is related to improper processing of URLs in HTTP requests, resulting in a path traversal vulnerability. If exploited, this vulnerability may allow arbitrary files on the server to be retrieved when processing crafted HTTP requests.

Recommendations For SHIRASAGI versions prior to 1.19.1, upgrade to version 1.19.1 or later to fix the security issue. As a temporary workaround, consider restricting access to the HTTP request handler to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-46898

Affected Products

Shirasagi

References · 13

• https://github.com/shirasagi/shirasagi/commit/5ac4685d7e4330f949f13219069107fc5d768934 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-46898 · Security Note
• https://osv.dev/vulnerability/CVE-2024-46898 · Vendor Advisory
• https://t.me/cvenotify/98029 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1846168298846621892 · Twitter Post
• https://twitter.com/CveFindCom/status/1846076425045979544 · Twitter Post
• https://t.me/cvedetector/7885 · Telegram Post
• https://ss-proj.org · Note
• https://t.me/cvenotify/98591 · Telegram Post
• https://twitter.com/oktsec/status/1846108151357084003 · Twitter Post
• https://jvn.jp/en/jp/JVN58721679 · Note
• https://twitter.com/CVEnew/status/1846074115892904404 · Twitter Post
• https://twitter.com/cracbot/status/1847518147802518010 · Twitter Post