CVE-2024-31450lowCWE-22

CVE-2024-31450: fallo de gravedad baja en owncast

Owncast vulnerable to arbitrary file deletion in emoji.go (GHSL-2023-277)

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear owncast+ Monitorear github.com/owncast/owncast

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

8Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 2.7epss 1.0%
Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. The Owncast application exposes an administrator API at the URL /api/admin. The emoji/delete endpoint of said API allows administrators to delete custom emojis, which are saved on disk. The parameter name is taken from the JSON request and directly appended to the filepath that points to the emoji to delete. By using path traversal sequences (../), attackers with administrative privileges can exploit this endpoint to delete arbitrary files on the system, outside of the emoji directory. This vulnerability is fixed in 0.1.3.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Productos afectados
owncast · owncast
CVEs relacionadas — owncast

En el mismo producto, de las más peligrosas a las menos.

CVE-2021-39183HIGHUnsafe inline XSS OwncastEPSS 0.8%CVE-2024-29026HIGHOwncast cross origin requestEPSS 0.4%