Vulnerability · Published Jan 29, 2024 · Assigned by GitHub_M
CVE-2024-23822Thruk Incorrect limitation of a pathname to a restricted directory (Path Traversal) (CWE-22)
Medium 5.4
In plain English
A medium-severity path traversal in Thruk from sni. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities).
Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)1.4%top 26.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Thruk is a multibackend monitoring webinterface. Prior to 3.12, the Thruk web monitoring application presents a vulnerability in a file upload form that allows a threat actor to arbitrarily upload files to the server to any path they desire and have permissions for. This vulnerability is known as Path Traversal or Directory Traversal. Version 3.12 fixes the issue.
Affected products (as reported)
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
References
- https://github.com/sni/Thruk/security/advisories/GHSA-4mrh-mx7x-rqjx x_refsource_CONFIRM
- https://github.com/sni/Thruk/commit/1aa9597cdf2722a69651124f68cbb449be12cc39 x_refsource_MISC