PT-2024-35397 · Statmatic · Statmatic

Samschroderbsg · Published 2024-11-19 · Updated 2024-11-20 · CVE-2024-52600

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Statmatic versions prior to 5.17.0

Description The issue allows assets uploaded with specially crafted filenames to be placed in a different location than configured, affecting front-end forms with assets fields and other areas where assets can be uploaded. This can potentially override existing files on the server. However, traversal outside an asset container is not possible.

Recommendations For versions prior to 5.17.0, update to version 5.17.0 to resolve the issue. As a temporary workaround, consider restricting upload permissions to minimize the risk of exploitation. Additionally, restrict access to areas where assets can be uploaded to reduce the potential impact.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-52600

GHSA-P7F6-8MCM-FWV3

Affected Products

Statmatic

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52600.json · Exploit
• https://osv.dev/vulnerability/GHSA-p7f6-8mcm-fwv3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-52600 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-52600 · Security Note
• https://github.com/statamic/cms · Note
• https://github.com/statamic/cms/commit/4cc2c9bd0f39a93b3fc7e9ef0f12792576fd380d · Note
• https://github.com/statamic/cms/commit/400875b20f40e1343699d536a432a6fc284346da · Note
• https://github.com/statamic/cms/commit/0c07c10009a2439c8ee56c8faefd1319dc6e388d · Note
• https://github.com/statamic/cms/security/advisories/GHSA-p7f6-8mcm-fwv3 · Note
• https://t.me/cvedetector/11456 · Telegram Post
• https://twitter.com/CVEnew/status/1859223910522454460 · Twitter Post