PT-2024-34545 · Vegam 4I · Vegam 4I

Rahul Kadavil

·

Published

2024-11-20

·

Updated

2025-01-09

·

CVE-2024-51163

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions: Vegam 4i versions 6.3.47.0 and earlier
Description: A Local File Inclusion issue allows a remote attacker to obtain sensitive information through the print label function. The filePathList parameter is susceptible to this issue, enabling a malicious user to include files from the web server, such as web.config or /etc/hosts, leading to the disclosure of sensitive information.
Recommendations: For versions 6.3.47.0 and earlier, consider disabling the print label function until a patch is available. Restrict access to sensitive files on the web server to minimize the risk of exploitation. Avoid using the filePathList parameter in the affected print labelling function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Out of bounds Read

Information Disclosure

Weakness Enumeration

CWE-125CWE-200

Related Identifiers

CVE-2024-51163

Affected Products

Vegam 4I