CVE-2024-10933 OpenBSD readdir directory traversal
Attackers can traverse directories on untrusted file systems in OpenBSD, potentially reading or modifying files outside intended boundaries.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-10933?
CVE-2024-10933 is a medium-severity path traversal vulnerability in Openbsd Openbsd, published on 5 Dec 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
In OpenBSD 7.5 before errata 009 and OpenBSD 7.4 before errata 022, exclude any '/' in readdir name validation to avoid unexpected directory traversal on untrusted file systems.
Weakness: CWE-22
Which versions are affected by CVE-2024-10933?
It affects 1 product.
Products include Openbsd Openbsd.
How do I fix CVE-2024-10933?
No fix has been published for CVE-2024-10933 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-10933 being exploited?
There is no known exploitation of CVE-2024-10933 in the wild and no public exploit code.
Other vulnerabilities in Openbsd Openbsd
Sources
Also known as GHSA-6pwm-f65f-3g86.