CVE-2024-3584criticalCWE-20

CVE-2024-3584: fallo crítico en qdrant/qdrant

Path Traversal in qdrant/qdrant

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear qdrant/qdrant+ Monitorear qdrant

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.8epss 0.5%
qdrant/qdrant version 1.9.0-dev is vulnerable to path traversal due to improper input validation in the `/collections/{name}/snapshots/upload` endpoint. By manipulating the `name` parameter through URL encoding, an attacker can upload a file to an arbitrary location on the system, such as `/root/poc.txt`. This vulnerability allows for the writing and overwriting of arbitrary files on the server, potentially leading to a full takeover of the system. The issue is fixed in version 1.9.0.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
qdrant · qdrant/qdrant
CVEs relacionadas — qdrant/qdrant

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-2221CRITICALPath Traversal and Arbitrary File Upload Vulnerability in qdrant/qdrantEPSS 1.8%CVE-2024-3829CRITICALArbitrary File Read and Write during Snapshot Recovery in qdrant/qdrantEPSS 0.9%