CVE-2024-23822
Thruk Incorrect limitation of a pathname to a restricted directory (Path Traversal) (CWE-22)
Vexday Risk Score
13Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 5.4EPSS 1.4%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
29 Jan 2024Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
Thruk is a multibackend monitoring webinterface. Prior to 3.12, the Thruk web monitoring application presents a vulnerability in a file upload form that allows a threat actor to arbitrarily upload files to the server to any path they desire and have permissions for. This vulnerability is known as Path Traversal or Directory Traversal. Version 3.12 fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Affected products
sni · ThrukWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →