CVE-2024-5581: Allegra unzipFile Directory Traversal Remote Code Execution Vulnerability
First published: Fri Nov 22 2024(Updated: )
Allegra unzipFile Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Authentication is required to exploit this vulnerability. The specific flaw exists within the unzipFile method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of LOCAL SERVICE. Was ZDI-CAN-23453.
Credit: zdi-disclosures@trendmicro.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Allegro |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-5581?
CVE-2024-5581 is a high severity vulnerability that allows remote code execution.
How does CVE-2024-5581 allow exploitation?
CVE-2024-5581 can be exploited through directory traversal in the unzipFile functionality.
What is required to exploit CVE-2024-5581?
Authentication is required to exploit CVE-2024-5581 on affected installations.
What are the consequences of CVE-2024-5581?
Exploitation of CVE-2024-5581 can lead to arbitrary code execution on the server hosting Allegra.
How do I fix CVE-2024-5581?
To fix CVE-2024-5581, update to the patched version of Allegra provided in the latest release notes.
- agent/weakness
- agent/references
- agent/title
- agent/type
- agent/first-publish-date
- agent/description
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/severity
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/trending
- agent/source
- agent/tags
- collector/zdi-advisory
- source/ZDI
- alias/ZDI-24-1164
- alias/ZDI-CAN-23453
- alias/CVE-2024-5581
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/allegra
- canonical/allegro