Vulnerability · Published Jan 9, 2024 · Assigned by VulDB

CVE-2024-0341Inis GET Request File.php path traversal

Low 3.5

In plain English

A low-severity security flaw in Inis. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).

Severity (CVSS 3.1)3.5Low

Exploit odds (30 days)0.6%top 50.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in Inis up to 2.0.1. It has been rated as problematic. This issue affects some unknown processing of the file /app/api/controller/default/File.php of the component GET Request Handler. The manipulation of the argument path leads to path traversal: '../filedir'. The exploit has been disclosed to the public and may be used. The identifier VDB-250109 was assigned to this vulnerability.

Affected products (as reported)

Vendor	Product	Versions
n/a	Inis	2.0.02.0.1

Weakness: CWE-24 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://vuldb.com/?id.250109 vdb-entry, technical-description
https://vuldb.com/?ctiid.250109 signature, permissions-required
https://note.zhaoj.in/share/VYx8H9u8gyHw broken-link, exploit