FeedlyFeedly
CVEsCVEs
Threat IntelligenceThreat Intelligence
Threat IntelligenceThreat Intelligence
Log in
ChangelogChangelog
ChangelogChangelog
Log in
Log in
Start Free Trial
Start Free Trial
FeedlyFeedly
CVEsCVEs
Threat IntelligenceThreat Intelligence
Threat IntelligenceThreat Intelligence
Log in
ChangelogChangelog
ChangelogChangelog
Log in
Log in
Start Free Trial
Start Free Trial

Exploit
CVE-2024-0882

Path Traversal: '../filedir' (CWE-24)

Published: Jan 25, 2024 / Updated: 9mo ago

010
CVSS 7.5EPSS 0.05%High
CVE info copied to clipboard

A vulnerability was found in qwdigital LinkWechat 5.1.0. It has been classified as problematic. This affects an unknown part of the file /linkwechat-api/common/download/resource of the component Universal Download Interface. The manipulation of the argument name with the input /profile/../../../../../etc/passwd leads to path traversal: '../filedir'. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252033 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Timeline

CVE Assignment

NVD published the first details for CVE-2024-0882

Jan 25, 2024 at 11:15 AM
First Article

Feedly found the first article mentioning CVE-2024-0882. See article

Jan 25, 2024 at 7:03 PM / CVE
CVSS Estimate

Feedly estimated the CVSS score as MEDIUM

Jan 25, 2024 at 7:05 PM
Proof of Concept (PoC) Released

A proof of concept exploit has been released

Jan 31, 2024 at 12:10 PM
EPSS

EPSS Score was set to: 0.05% (Percentile: 12.1%)

Jan 31, 2024 at 5:35 PM
CVSS

A CVSS base score of 7.5 has been assigned.

May 14, 2024 at 3:10 PM / nvd
Static CVE Timeline Graph

Affected Systems

Linkwechat/linkwechat
+null more

Exploits

https://github.com/biantaibao/LinkWechat-Scrm_arbitrary-file-download-vulnerability/blob/main/report.md
+null more

Attack Patterns

CAPEC-126: Path Traversal
+null more

News

Update Sat Aug 10 14:30:47 UTC 2024
Recent Commits to cve:main / 3mo
Update Sat Aug 10 14:30:47 UTC 2024
Update Mon Apr 1 02:01:52 UTC 2024
Recent Commits to cve:main / 7mo
Update Mon Apr 1 02:01:52 UTC 2024
CVE-2024-0882 Exploit
inTheWild.io Exploits / 9mo
CVE Id : CVE-2024-0882 Published Date: 2024-01-31T17:32:00+00:00 A vulnerability was found in qwdigital LinkWechat 5.1.0. It has been classified as problematic. This affects an unknown part of the file /linkwechat-api/common/download/resource of the component Universal Download Interface. The manipulation of the argument name with the input /profile/../../../../../etc/passwd leads to path traversal: '../filedir'. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252033 was assigned to this vulnerability.
CVE-2024-0882
Newest CVEs from Tenable / 9mo
A vulnerability was found in qwdigital LinkWechat 5.1.0. The identifier VDB-252033 was assigned to this vulnerability.
NA - CVE-2024-0882 - A vulnerability was found in qwdigital...
Latest articles about All products / 9mo
A vulnerability was found in qwdigital LinkWechat 5.1.0. This affects an unknown part of the file /linkwechat-api/common/download/resource of the component Universal Download Interface.
See 4 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:None
User Interaction:None
Scope:Unchanged
Confidentiality:High
Integrity:None
Availability Impact:None

Categories

CVSS 7.5(51562)CWE-24(56)CWE-22(6658)Linkwechat(1)

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI

Feedly Threat Intelligence30-day free trial