Vulnerability · Published Oct 25, 2024 · Assigned by GitHub_M

CVE-2024-49381Plenti arbitrary file deletion vulnerability

High 7.7

In plain English

A high-severity injection in plenti from plentico. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)7.7High

Exploit odds (30 days)0.8%top 44.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Plenti, a static site generator, has an arbitrary file deletion vulnerability in versions prior to 0.7.2. The `/postLocal` endpoint is vulnerable to an arbitrary file write deletion when a plenti user serves their website. This issue may lead to information loss. Version 0.7.2 fixes the vulnerability.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/plentico/plenti	0.7.2	GHSA-6h8w-hrfp-pffx
Go	github.com/plentico/plenti	0.7.2	GO-2024-3214

Affected products (as reported)

Vendor	Product	Versions
plentico	plenti	< 0.7.2

Weakness: CWE-74 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P

References

https://securitylab.github.com/advisories/GHSL-2024-297_GHSL-2024-298_plenti/ x_refsource_CONFIRM
https://github.com/plentico/plenti/blob/01825e0dcd3505fac57adc2edf29f772d585c008/cmd/serve.go#L205 x_refsource_MISC
https://github.com/plentico/plenti/releases/tag/v0.7.2 x_refsource_MISC