CVE-2024-25975

2024-05-2914:15:21

CWE-73

551230f0-3615-47bd-b7cc-93e92e730bbf

web.nvd.nist.gov

application security

path traversal

arbitrary file overwrite

json file

web server access

6.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.7%

JSON

The application implements an up- and downvote function which alters a value within a JSON file. The POST parameters are not filtered properly and therefore an arbitrary file can be overwritten. The file can be controlled by an authenticated attacker, the content cannot be controlled. It is possible to overwrite all files for which the webserver has write access. It is required to supply a relative path (path traversal).

CNA Affected

[
  {
    "defaultStatus": "affected",
    "product": "HAWKI",
    "repo": "https://github.com/HAWK-Digital-Environments/HAWKI",
    "vendor": "Interaction Design Team at the University of Applied Sciences and Arts in Hildesheim/Germany",
    "versions": [
      {
        "status": "affected",
        "version": "versions before commit 146967f",
        "versionType": "custom"
      }
    ]
  }
]