Vulnerability · Published Apr 21, 2022 · Assigned by dell
CVE-2022-24424
High 7.5
In plain English
A high-severity path traversal in AppSync from Dell. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.7%top 22.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Dell EMC AppSync versions from 3.9 to 4.3 contain a path traversal vulnerability in AppSync server. A remote unauthenticated attacker may potentially exploit this vulnerability to gain unauthorized read access to the files stored on the server filesystem, with the privileges of the running web application.
Affected products (as reported)
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://www.dell.com/support/kbdoc/000197433 x_refsource_MISC