CVE-2024-9405 - An incorrect limitation of a path to a restricted directory (path traversal) has been detected in Pluck CMS, affecting version 4.7.18

Back Back to CVE browser

MEDIUM

An incorrect limitation of a path to a restricted directory (path traversal) has been detected in Pluck CMS, affecting version 4.7.18

Published Oct 1, 2024

5.3

MEDIUM

CVSS 3.1

EPSS 0.46%

Description

An incorrect limitation of a path to a restricted directory (path traversal) has been detected in Pluck CMS, affecting version 4.7.18. An unauthenticated attacker could extract sensitive information from the server via the absolute path of a file located in the same directory or subdirectory as the module, but not from recursive directories.

Affected products

Vendor Pluck CMS Product Pluck CMS Default
unaffected
- Version
  4.7.18
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Pluck CMS

unaffected

Version	Status	Constraints
4.7.18	affected	-

Vendor Pluck-Cms Product Pluckcms Default
n/a
- Version
  4.7.18
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Pluck-Cms

Pluckcms

n/a

Version	Status	Constraints
4.7.18	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-23

References (2)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-49919		Advisory
https://www.incibe.es/en/incibe-cert/notices/aviso/incorrect-limitation-path-restricted-directory-pluck-cms