CVE-2024-3584criticalCWE-20

CVE-2024-3584: falha crítica em qdrant/qdrant

Path Traversal in qdrant/qdrant

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar qdrant/qdrant+ Monitorar qdrant

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.8epss 0.5%
qdrant/qdrant version 1.9.0-dev is vulnerable to path traversal due to improper input validation in the `/collections/{name}/snapshots/upload` endpoint. By manipulating the `name` parameter through URL encoding, an attacker can upload a file to an arbitrary location on the system, such as `/root/poc.txt`. This vulnerability allows for the writing and overwriting of arbitrary files on the server, potentially leading to a full takeover of the system. The issue is fixed in version 1.9.0.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
qdrant · qdrant/qdrant
CVEs relacionadas — qdrant/qdrant

No mesmo produto, das mais perigosas para as menos.

CVE-2024-2221CRITICALPath Traversal and Arbitrary File Upload Vulnerability in qdrant/qdrantEPSS 1.8%CVE-2024-3829CRITICALArbitrary File Read and Write during Snapshot Recovery in qdrant/qdrantEPSS 0.9%