CVEvulnerability

CVE-2024-25154

5.3 MEDIUM Published 2024-03-13 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2024-03-13
Last modified
2026-06-17
Assigner
df4dee71-de3a-4139-9588-11b62fe6c0ff
CVSS 3.1 (df4dee71-de3a-4139-9588-11b62fe6c0ff)
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-22

Description

Improper URL validation leads to path traversal in FileCatalyst Direct 3.8.8 and earlier allowing an encoded payload to cause the web server to return files located outside of the web root which may lead to data leakage.  

Affected configurations

• fortra filecatalyst direct (>= 3.0.0 < 3.8.9)

Related

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References