CVE-2024-11312: critical vulnerability in TRCore DVC
TRCore DVC - Arbitrary File Upload through Path Traversal
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.8epss 1.4%
The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to upload arbitrary files to any directory, leading to arbitrary code execution by uploading webshells.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
TRCore · DVCRelated CVEs — TRCore DVC
In the same product, most dangerous first.
CVE-2024-11315CRITICALTRCore DVC - Arbitrary File Upload through Path TraversalEPSS 1.4%CVE-2024-11314CRITICALTRCore DVC - Arbitrary File Upload through Path TraversalEPSS 1.4%CVE-2024-11313CRITICALTRCore DVC - Arbitrary File Upload through Path TraversalEPSS 1.4%CVE-2024-11311CRITICALTRCore DVC - Arbitrary File Upload through Path TraversalEPSS 1.4%CVE-2024-11310HIGHTRCore DVC - Arbitrary File Read through Path TraversalEPSS 0.7%CVE-2024-11309HIGHTRCore DVC - Arbitrary File Read through Path TraversalEPSS 0.7%