Vulnerability · Published Dec 20, 2024 · Assigned by INCIBE
CVE-2024-12014Path Traversal vulnerability in eSignaViewer Allow Unauthorized File Access
Low 2.0
In plain English
A low-severity improper input validation in eSigna from Lleidanet PKI. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).
Severity (CVSS 4.0)2.0Low
Exploit odds (30 days)0.4%top 69.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Path Traversal vulnerability in the eSignaViewer component in eSigna product versions 1.0 to 1.5 on all platforms allow an unauthenticated attacker to access arbitrary files in the document system via manipulation of file paths and object identifiers.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Lleidanet PKI | eSigna | see references |
Weakness: CWE-20 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N