PT-2024-33494 · Plenti+1 · Plenti+1

Kevin Stubbings + 1 · Published 2024-10-25 · Updated 2025-05-06 · CVE-2024-49380

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Plenti versions prior to 0.7.2

Description The issue is related to an arbitrary file write vulnerability. The /postLocal endpoint is vulnerable, which may lead to Remote Code Execution when a Plenti user serves their website.

Recommendations For versions prior to 0.7.2, update to version 0.7.2 to fix the vulnerability. As a temporary workaround, consider restricting access to the /postLocal endpoint until the update is applied.

Exploit

Fix

RCE

Special Elements Injection

OS Command Injection

Weakness Enumeration

CWE-74

CWE-78

Related Identifiers

CVE-2024-49380

GHSA-2P96-P7QH-4RGR

GO-2024-3213

OPENSUSE-SU-2024:0350-1

OPENSUSE-SU-2024:14447-1

OPENSUSE-SU-2024_3911-1

SUSE-SU-2024:3911-1

Affected Products

Plenti

Suse

References · 73

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/49xxx/CVE-2024-49380.json · Exploit
• 🔥 https://securitylab.github.com/advisories/GHSL-2024-297_GHSL-2024-298_plenti · Exploit
• https://osv.dev/vulnerability/CVE-2024-49380 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2p96-p7qh-4rgr · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:0350-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-3213 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14447-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-49380 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2024:3911-1 · Vendor Advisory
• https://github.com/plentico/plenti/releases/tag/v0.7.2 · Note
• https://github.com/plentico/plenti/blob/01825e0dcd3505fac57adc2edf29f772d585c008/cmd/serve.go#L205 · Note
• https://github.com/plentico/plenti · Note
• https://suse.com/security/cve/CVE-2024-9180 · Note
• https://suse.com/security/cve/CVE-2024-47003 · Note
• https://suse.com/support/update/announcement/2024/suse-su-20243911-1 · Note