PT-2024-39614 · Pluck Cms · Pluck Cms

David Utón Amaya · Published 2024-10-01 · Updated 2024-10-04 · CVE-2024-9405

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Pluck CMS version 4.7.18

Description An issue has been detected in Pluck CMS where there is an incorrect limitation of a path to a restricted directory, also known as path traversal. This allows an unauthenticated attacker to extract sensitive information from the server via the absolute path of a file located in the same directory or subdirectory as the module. However, this does not affect recursive directories. The impact of this issue is unauthorized access to sensitive files.

Recommendations For Pluck CMS version 4.7.18, patch immediately and review file permissions to mitigate the risk of unauthorized access to sensitive files. As a temporary workaround, consider restricting access to sensitive files and directories until a patch is applied.

Fix

Relative Path Traversal

Weakness Enumeration

CWE-23

Related Identifiers

CVE-2024-9405

Affected Products

Pluck Cms

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-9405 · Security Note
• https://incibe.es/en/incibe-cert/notices/aviso/incorrect-limitation-path-restricted-directory-pluck-cms · Note
• https://t.me/cvedetector/6742 · Telegram Post
• https://twitter.com/CVEnew/status/1841080419870994815 · Twitter Post
• https://twitter.com/oktsec/status/1841095140523360738 · Twitter Post