CVE-2024-21518: Path Traversal
First published: Sat Jun 22 2024(Updated: )
This affects versions of the package opencart/opencart from 4.0.0.0. A Zip Slip issue was identified via the marketplace installer due to improper sanitization of the target path, allowing files within a malicious archive to traverse the filesystem and be extracted to arbitrary locations. An attacker can create arbitrary files in the web root of the application and overwrite other existing files by exploiting this vulnerability.
Credit: report@snyk.io report@snyk.io
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/opencart/opencart | >=4.0.0.0 | |
| OpenCart | >=4.0.0.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://security.snyk.io/vuln/SNYK-PHP-OPENCARTOPENCART-7266578
- https://github.com/opencart/opencart/blob/04c1724370ab02967d3b4f668c1b67771ecf1ff4/upload/admin/controller/marketplace/installer.php%23L383C1-L383C1
- https://nvd.nist.gov/vuln/detail/CVE-2024-21518
- https://github.com/advisories/GHSA-m7r8-2r98-vppj (Advisory)
Frequently Asked Questions
What is the severity of CVE-2024-21518?
CVE-2024-21518 is classified as a high-severity vulnerability due to its potential for arbitrary file extraction.
How do I fix CVE-2024-21518?
To fix CVE-2024-21518, upgrade to a version of OpenCart that is not affected by this vulnerability.
What versions are affected by CVE-2024-21518?
CVE-2024-21518 affects all versions of OpenCart starting from 4.0.0.0.
What is a Zip Slip vulnerability in CVE-2024-21518?
A Zip Slip vulnerability allows a malicious zip file to extract files to arbitrary locations in the file system.
Where can I find more information about CVE-2024-21518?
For more information about CVE-2024-21518, check security advisories and databases related to OpenCart.
- agent/first-publish-date
- agent/type
- agent/remedy
- agent/references
- agent/severity
- agent/event
- agent/author
- agent/weakness
- agent/description
- collector/mitre-cve
- source/MITRE
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-m7r8-2r98-vppj
- alias/CVE-2024-21518
- agent/software-canonical-lookup
- agent/last-modified-date
- collector/github-advisory
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-api
- package-manager/composer
- vendor/opencart
- canonical/opencart
- version/opencart/4.0.0.0