CVE-2024-4701 - Path Traversal vulnerability via File Uploads in Genie

CRITICAL

Path Traversal vulnerability via File Uploads in Genie

Published May 10, 2024

9.9

CRITICAL

CVSS 3.1

EPSS 24.63%

A path traversal issue potentially leading to remote code execution in Genie for all versions prior to 4.3.18

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

unaffected

Version	Status	Constraints
0	affected	<=4.3.18

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Version	Status	Constraints
0	affected	<4.3.18

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-1837		Advisory
https://github.com/Netflix/genie/commit/6bad017d8078c94e80d6c6fe8abd693910bf55cf
https://github.com/Netflix/genie/pull/1217
https://github.com/Netflix/genie/releases/tag/v4.3.18
https://github.com/Netflix/genie/security/advisories/GHSA-wpcv-5jgp-69f3
https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2024-001.md
https://github.com/advisories/GHSA-wpcv-5jgp-69f3		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-4701