CVE-2023-34409 Path traversal in n/a
Unauthenticated attackers can exploit path traversal in PMM server to access protected API routes, leading to privilege escalation and information disclosure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-34409?
CVE-2023-34409 is a critical path traversal vulnerability in n/a, published on 6 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Percona Monitoring and Management (PMM) server 2.x before 2.37.1, the authenticate function in auth_server.go does not properly formalize and sanitize URL paths to reject path traversal attempts. This allows an unauthenticated remote user, when a crafted POST request is made against unauthenticated API routes, to access otherwise protected API routes leading to escalation of privileges and information disclosure.
Weakness: CWE-22
Which versions are affected by CVE-2023-34409?
It affects 1 product.
Products include Percona Monitoring and Management.
How do I fix CVE-2023-34409?
No fix has been published for CVE-2023-34409 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-34409 being exploited?
There is no known exploitation of CVE-2023-34409 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-jxc6-p894-679v.