CVE-2024-25975 Arbitrary File Overwrite

2024-05-2913:13:14

CWE-73

SEC-VLab

www.cve.org

arbitrary file overwrite

json file

path traversal

webserver write access

relative path

6.5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.7%

JSON

The application implements an up- and downvote function which alters a value within a JSON file. The POST parameters are not filtered properly and therefore an arbitrary file can be overwritten. The file can be controlled by an authenticated attacker, the content cannot be controlled. It is possible to overwrite all files for which the webserver has write access. It is required to supply a relative path (path traversal).

CNA Affected

[
  {
    "defaultStatus": "affected",
    "product": "HAWKI",
    "repo": "https://github.com/HAWK-Digital-Environments/HAWKI",
    "vendor": "Interaction Design Team at the University of Applied Sciences and Arts in Hildesheim/Germany",
    "versions": [
      {
        "status": "affected",
        "version": "versions before commit 146967f",
        "versionType": "custom"
      }
    ]
  }
]