CVE-2024-25975 Vulnerability Details

  /     /     /  

CVE-2024-25975 Metadata Quick Info

CVE Published: 29/05/2024 | CVE Updated: 01/08/2024 | CVE Year: 2024
Source: SEC-VLab | Vendor: Interaction Design Team at the University of Applied Sciences and Arts in Hildesheim/Germany | Product: HAWKI
Status : PUBLISHED

---

CVE-2024-25975 Description

The application implements an up- and downvote function which alters a value within a JSON file. The POST parameters are not filtered properly and therefore an arbitrary file can be overwritten. The file can be controlled by an authenticated attacker, the content cannot be controlled. It is possible to overwrite all files for which the webserver has write access. It is required to supply a relative path (path traversal).

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID: CWE-73
CWE Name: CWE-73 External Control of File Name or Path
Source: Interaction Design Team at the University of Applied Sciences and Arts in Hildesheim/Germany

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).