Vulnerability · Published May 26, 2024 · Assigned by VulDB
CVE-2024-5353anji-plus AJ-Report ZIP File decompress path traversal
Medium 6.3
In plain English
A medium-severity path traversal in AJ-Report from anji-plus. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).
Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.8%top 43.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability classified as critical has been found in anji-plus AJ-Report up to 1.4.1. This affects the function decompress of the component ZIP File Handler. The manipulation leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-266265 was assigned to this vulnerability.
Affected products (as reported)
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
References
- VDB-266265 | anji-plus AJ-Report ZIP File decompress path traversal vdb-entry, technical-description
- VDB-266265 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- https://github.com/anji-plus/report/issues/34 issue-tracking
- https://github.com/anji-plus/report/files/15363269/aj-report.pdf exploit