CVE-2024-25975: medium-severity vulnerability in Interaction Design Team at the University of…
Arbitrary File Overwrite
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.5epss 0.6%
The application implements an up- and downvote function which alters a value within a JSON file. The POST parameters are not filtered properly and therefore an arbitrary file can be overwritten. The file can be controlled by an authenticated attacker, the content cannot be controlled. It is possible to overwrite all files for which the webserver has write access. It is required to supply a relative path (path traversal).
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected products
Interaction Design Team at the University of Applied Sciences and Arts in Hildesheim/Germany · HAWKIRelated CVEs — Interaction Design Team at the University of…
In the same product, most dangerous first.