CVE-2024-33879: Path Traversal
An issue was discovered in VirtoSoftware Virto Bulk File Download 5.5.44 for SharePoint 2019. The Virto.SharePoint.FileDownloader/Api/Download.ashx isCompleted method allows arbitrary file download and deletion via absolute path traversal in the path parameter.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-33879?
CVE-2024-33879 has been classified with a critical severity due to its potential for arbitrary file download and deletion.
How do I fix CVE-2024-33879?
To mitigate CVE-2024-33879, users should update the Virto Bulk File Download plugin to version 5.5.45 or later.
What versions of Virto Bulk File Download are affected by CVE-2024-33879?
CVE-2024-33879 affects Virto Bulk File Download version 5.5.44.
Can CVE-2024-33879 be exploited remotely?
Yes, CVE-2024-33879 can be exploited remotely due to improper input validation allowing path traversal.
What impact does CVE-2024-33879 have on my SharePoint server?
CVE-2024-33879 may allow attackers to download or delete arbitrary files from the SharePoint server, compromising sensitive data.