CVE-2024-51483mediumCWE-22

CVE-2024-51483: falha de média gravidade em dgtlmoon changedetection.io

changedetection.io Path Traversal vulnerability

Publicada em

Seguir esta CVE+ Monitorar changedetection.io+ Monitorar changedetection-io

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Corrija em breve. Ela tem exploit funcional público.

ssvc Attendcvss 6.9epss 2.3%
changedetection.io is free, open source web page change detection software. Prior to version 0.47.5, when a WebDriver is used to fetch files, `source:file:///etc/passwd` can be used to retrieve local system files, where the more traditional `file:///etc/passwd` gets blocked. Version 0.47.5 fixes the issue.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
dgtlmoon · changedetection.io
CVEs relacionadas — dgtlmoon changedetection.io

No mesmo produto, das mais perigosas para as menos.

CVE-2024-32651CRITICALServer Side Template Injection in Jinja2 allows Remote Command ExecutionEPSS 85.3%CVE-2024-34061MEDIUMReflected cross site scripting in changedetection.ioEPSS 1.3%CVE-2026-25527MEDIUMchangedetection.io vulnerable to unauthenticated static path traversalEPSS 1.0%CVE-2024-56509HIGHchangedetection.io has Improper Input Validation Leading to LFR/Path TraversalEPSS 0.7%CVE-2024-51998HIGHPath traversal using file URI scheme without supplying hostname in changedetection.ioEPSS 0.7%CVE-2026-95272MEDIUMdgtlmoon changedetection.io Screenshot flask_app.py static_content path traversalEPSS 0.7%