CVE-2024-48914

🗓️ 15 Oct 2024 16:08:29Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 298 Views🌐 WEB

Vulnerability in Vendure's asset server plugin allows attacker to retrieve arbitrary file

Reporter	Title	Published	Views	Family All 18
GithubExploit	Exploit for CVE-2024-48914	21 Oct 202410:02	–	githubexploit
BDU FSTEC	The vulnerability of the Vendure corporate platform lies in improper cleaning of file paths and bypassing directories due to insufficient verification of input data. This allows attackers to disclose protected information or cause service failures.	31 Oct 202400:00	–	bdu_fstec
Circl	CVE-2024-48914	15 Oct 202410:56	–	circl
CNNVD	Vendure 输入验证错误漏洞	15 Oct 202400:00	–	cnnvd
Cvelist	CVE-2024-48914 Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy	15 Oct 202416:08	–	cvelist
Github Security Blog	Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy	15 Oct 202418:00	–	github
Nuclei	Vendure - Arbitrary File Read	26 Jun 202603:02	–	nuclei
NVD	CVE-2024-48914	15 Oct 202416:15	–	nvd
OpenVAS	Generic HTTP Directory Traversal / File Inclusion (Web Dirs) - Active Check	22 Jul 202100:00	–	openvas
OSV	CVE-2024-48914 Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy	15 Oct 202416:08	–	osv

Vulners

Vulnrichment

Node

vendure-ecommerce vendureRange<2.3.3

vendure-ecommerce vendureRange3.0.0–3.0.5

[
  {
    "vendor": "vendure-ecommerce",
    "product": "vendure",
    "versions": [
      {
        "version": "< 2.3.3",
        "status": "affected"
      },
      {
        "version": ">= 3.0.0, < 3.0.5",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/vendure-ecommerce/vendure/commit/e2ee0c43159b3d13b51b78654481094fdd4850c5
github	www.github.com/vendure-ecommerce/vendure/commit/e4b58af6822d38a9c92a1d8573e19288b8edaa1c
github	www.github.com/vendure-ecommerce/vendure/security/advisories/GHSA-r9mq-3c9r-fmjq
github	www.github.com/vendure-ecommerce/vendure/blob/801980e8f599c28c5059657a9d85dd03e3827992/packages/asset-server-plugin/src/plugin.ts

Parameter	Position	Path	Description	CWE
filename	path	assets/../<filename>	Path traversal in Vendure asset server allowing arbitrary file read via /assets/../<filename>.	CWE-22, CWE-20

17 Jun 2026 07:59Current

9High risk

Vulners AI Score9

CVSS 3.19.1

EPSS0.59798

SSVC

vendure asset server arbitrary files configuration files environment variables server vulnerability patches object storage minio s3 middleware