CVE-2024-51483mediumCWE-22

CVE-2024-51483: fallo de gravedad media en dgtlmoon changedetection.io

changedetection.io Path Traversal vulnerability

Publicada el

Seguir esta CVE+ Monitorear changedetection.io+ Monitorear changedetection-io

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Corrige pronto. Ella tiene exploit funcional público.

ssvc Attendcvss 6.9epss 2.3%
changedetection.io is free, open source web page change detection software. Prior to version 0.47.5, when a WebDriver is used to fetch files, `source:file:///etc/passwd` can be used to retrieve local system files, where the more traditional `file:///etc/passwd` gets blocked. Version 0.47.5 fixes the issue.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Productos afectados
dgtlmoon · changedetection.io
CVEs relacionadas — dgtlmoon changedetection.io

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-32651CRITICALServer Side Template Injection in Jinja2 allows Remote Command ExecutionEPSS 85.3%CVE-2024-34061MEDIUMReflected cross site scripting in changedetection.ioEPSS 1.3%CVE-2026-25527MEDIUMchangedetection.io vulnerable to unauthenticated static path traversalEPSS 1.0%CVE-2024-56509HIGHchangedetection.io has Improper Input Validation Leading to LFR/Path TraversalEPSS 0.7%CVE-2024-51998HIGHPath traversal using file URI scheme without supplying hostname in changedetection.ioEPSS 0.7%CVE-2026-95272MEDIUMdgtlmoon changedetection.io Screenshot flask_app.py static_content path traversalEPSS 0.7%