CVE-2024-21518: Path Traversal

Published Jun 22, 2024

Updated

This affects versions of the package opencart/opencart from 4.0.0.0. A Zip Slip issue was identified via the marketplace installer due to improper sanitization of the target path, allowing files within a malicious archive to traverse the filesystem and be extracted to arbitrary locations. An attacker can create arbitrary files in the web root of the application and overwrite other existing files by exploiting this vulnerability.

Affected Software

2 affected components

composer/opencart/opencart>=4.0.0.0

OpenCart opencart>=4.0.0.0

Remediation

Patch Available

https://github.com/opencart/opencart/blob/04c1724370ab02967d3b4f668c1b67771ecf1ff4/upload/admin/controller/marketplace/installer.php%23L383C1-L383C1

Event History

Jun 22, 2024

CVE Published

via MITRE·05:00 AM

Data Sourced

via MITRE·05:00 AM

DescriptionSeverityWeakness

Advisory Published

via GitHub·06:30 AM

Frequently Asked Questions

What is the severity of CVE-2024-21518?

CVE-2024-21518 is classified as a high-severity vulnerability due to its potential for arbitrary file extraction.

How do I fix CVE-2024-21518?

To fix CVE-2024-21518, upgrade to a version of OpenCart that is not affected by this vulnerability.

What versions are affected by CVE-2024-21518?

CVE-2024-21518 affects all versions of OpenCart starting from 4.0.0.0.

What is a Zip Slip vulnerability in CVE-2024-21518?

A Zip Slip vulnerability allows a malicious zip file to extract files to arbitrary locations in the file system.

Where can I find more information about CVE-2024-21518?

For more information about CVE-2024-21518, check security advisories and databases related to OpenCart.