CVE-2024-2053 Artica Proxy Unauthenticated LFI Protection Bypass Vulnerability

2024-03-0518:56:10

CWE-23

AHA

www.cve.org

cve-2024-2053

artica proxy

unauthenticated users

lfi

protection bypass

code execution

www-data user

arbitrary file requests

7.5 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.2%

JSON

The Artica Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the “www-data” user. This issue was demonstrated on version 4.50 of the The Artica-Proxy administrative web application attempts to prevent local file inclusion. These protections can be bypassed and arbitrary file requests supplied by unauthenticated users will be returned according to the privileges of the “www-data” user.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Artica Proxy",
    "vendor": "Artica Tech",
    "versions": [
      {
        "status": "affected",
        "version": "4.50"
      },
      {
        "status": "affected",
        "version": "4.40"
      }
    ]
  }
]