CVE-2024-2221criticalCWE-434

CVE-2024-2221: falha crítica em qdrant/qdrant

Path Traversal and Arbitrary File Upload Vulnerability in qdrant/qdrant

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar qdrant/qdrant

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.8epss 1.8%
qdrant/qdrant is vulnerable to a path traversal and arbitrary file upload vulnerability via the `/collections/{COLLECTION}/snapshots/upload` endpoint, specifically through the `snapshot` parameter. This vulnerability allows attackers to upload and overwrite any file on the filesystem, leading to potential remote code execution. This issue affects the integrity and availability of the system, enabling unauthorized access and potentially causing the server to malfunction.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
qdrant · qdrant/qdrant
CVEs relacionadas — qdrant/qdrant

No mesmo produto, das mais perigosas para as menos.

CVE-2024-3829CRITICALArbitrary File Read and Write during Snapshot Recovery in qdrant/qdrantEPSS 0.9%CVE-2024-3584CRITICALPath Traversal in qdrant/qdrantEPSS 0.5%