CVE-2024-34313: Path Traversal
Published Jun 24, 2024
·Updated
An issue in VPL Jail System up to v4.0.2 allows attackers to execute a directory traversal via a crafted request to a public endpoint.
Affected Software
1 affected component
VPL Jail System<=4.0.2
Event History
Jun 24, 2024
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·08:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
The vulnerable endpoint is public, and the CVSS vector indicates that exploitation can be performed remotely without authentication or user interaction. Attack complexity is rated low.
2
Which deployments should be treated as affected?
VPL Jail System versions up to and including 4.0.2 are identified as affected. The available information does not state whether the vulnerable public endpoint can be disabled or is enabled by default.
3
What is the potential impact of successful exploitation?
Successful directory traversal can result in high impact to confidentiality, integrity, and availability according to the CVSS assessment. The vulnerability is rated critical with a CVSS 3.1 score of 9.8.