CVE-2024-7928

FastAdmin lang path traversal

CVSS 5.3 MEDIUMEPSS 16.9%CWE-22

Vexday Risk Score

33Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS 5.3EPSS 16.9%KEV nãoPoC —Nuclei simMetasploit —Patch —

Lifecycle

19 Aug 2024Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

A vulnerability, which was classified as problematic, has been found in FastAdmin up to 1.3.3.20220121. Affected by this issue is some unknown functionality of the file /index/ajax/lang. The manipulation of the argument lang leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.3.4.20220530 is able to address this issue. It is recommended to upgrade the affected component.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Affected products

n/a · FastAdmin

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://vuldb.com/?ctiid.275114 https://vuldb.com/?id.275114 https://vuldb.com/?submit.392202 https://wiki.shikangsi.com/post/share/da0292b8-0f92-4e6e-bdb7-73f47b901acd