CVE-2024-1703: ZhongBangKeJi CRMEB openfile absolute path traversal

Published Feb 21, 2024

Updated

A vulnerability was found in ZhongBangKeJi CRMEB 5.2.2. It has been classified as problematic. This affects the function openfile of the file /adminapi/system/file/openfile. The manipulation leads to absolute path traversal. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-254391. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

1 affected component

crmeb crmeb=5.2.2

Event History

Feb 21, 2024

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-1703?

CVE-2024-1703 has been classified as a problematic vulnerability.

How does CVE-2024-1703 affect ZhongBangKeJi CRMEB?

CVE-2024-1703 affects the function openfile in the file /adminapi/system/file/openfile, leading to absolute path traversal.

How can I fix CVE-2024-1703 in CRMEB version 5.2.2?

To fix CVE-2024-1703, it is recommended to apply the latest security patches provided by the vendor for CRMEB version 5.2.2.

What could be the impact of exploiting CVE-2024-1703?

Exploiting CVE-2024-1703 could allow an attacker to access arbitrary files on the server via absolute path traversal.

Is CVE-2024-1703 publicly disclosed?

Yes, CVE-2024-1703 has been publicly disclosed and may be exploited by attackers.