Exploit for CVE-2024-48914

🗓️ 21 Oct 2024 10:02:05Reported by EQSTLabType

CVE-2024-48914 vendure-ecommerce Arbitrary file read and DoS Vulnerability. Prior to versions 3.0.5 and 2.3.3, vulnerability allows traversal of server file system and retrieval of arbitrary files, resulting in DoS. Patches available in versions 3.0.5 and 2.3.3 with workarounds like object storage or middleware to block requests with specific URLs

Reporter	Title	Published	Views	Family All 18
BDU FSTEC	The vulnerability of the Vendure corporate platform lies in improper cleaning of file paths and bypassing directories due to insufficient verification of input data. This allows attackers to disclose protected information or cause service failures.	31 Oct 202400:00	–	bdu_fstec
Circl	CVE-2024-48914	15 Oct 202410:56	–	circl
CNNVD	Vendure 输入验证错误漏洞	15 Oct 202400:00	–	cnnvd
CVE	CVE-2024-48914	15 Oct 202416:08	–	cve
Cvelist	CVE-2024-48914 Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy	15 Oct 202416:08	–	cvelist
Github Security Blog	Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy	15 Oct 202418:00	–	github
Nuclei	Vendure - Arbitrary File Read	22 Jun 202605:20	–	nuclei
NVD	CVE-2024-48914	15 Oct 202416:15	–	nvd
OpenVAS	Generic HTTP Directory Traversal / File Inclusion (Web Dirs) - Active Check	22 Jul 202100:00	–	openvas
OSV	CVE-2024-48914 Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy	15 Oct 202416:08	–	osv