Vulnerability · Published Jul 21, 2024 · Assigned by VulDB

CVE-2024-6949Gargaj wuhu path traversal

Medium 4.3

In plain English

A medium-severity path traversal in wuhu from Gargaj. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.5%top 55.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability classified as problematic was found in Gargaj wuhu up to 3faad49bfcc3895e9ff76a591d05c8941273d120. Affected by this vulnerability is an unknown functionality of the file /pages.php?edit=News. The manipulation leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The associated identifier of this vulnerability is VDB-272071.

Affected products (as reported)

Vendor	Product	Versions
Gargaj	wuhu	3faad49bfcc3895e9ff76a591d05c8941273d120

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

VDB-272071 | Gargaj wuhu path traversal vdb-entry
VDB-272071 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #375146 | wuhu.function.hu Lightweight Party Management System pary 2024 Local File Inclusion third-party-advisory
https://github.com/DeepMountains/Mirage/blob/main/CVE4-2.md exploit