Vulnerability · Published Nov 1, 2024 · Assigned by GitHub_M

CVE-2024-51483changedetection.io Path Traversal vulnerability

Medium 6.9

In plain English

A medium-severity path traversal in changedetection.io from dgtlmoon. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 83% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)2.3%top 16.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Nuclei

Official description

changedetection.io is free, open source web page change detection software. Prior to version 0.47.5, when a WebDriver is used to fetch files, `source:file:///etc/passwd` can be used to retrieve local system files, where the more traditional `file:///etc/passwd` gets blocked. Version 0.47.5 fixes the issue.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	changedetection-io	0.47.5	GHSA-cwgg-57xj-g77r
PyPI	changedetection-io	0.47.5	PYSEC-2026-1240

Affected products (as reported)

Vendor	Product	Versions
dgtlmoon	changedetection.io	< 0.47.5

Weakness: CWE-22 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-cwgg-57xj-g77r x_refsource_CONFIRM
https://github.com/dgtlmoon/changedetection.io/blob/master/changedetectionio/model/Watch.py#L19 x_refsource_MISC
https://github.com/dgtlmoon/changedetection.io/blob/master/changedetectionio/processors/__init__.py#L35 x_refsource_MISC
https://github.com/user-attachments/files/17591630/CL-ChangeDetection.io.Path.Travsersal-311024-181039.pdf x_refsource_MISC