CVE-2024-23768 Path traversal in n/a
Authenticated users can bypass folder permissions to access unauthorized files and datasets via path traversal in Dremio.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-23768?
CVE-2024-23768 is a high-severity path traversal vulnerability in n/a, published on 22 Jan 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Dremio before 24.3.1 allows path traversal. An authenticated user who has no privileges on certain folders (and the files and datasets in these folders) can access these folders, files, and datasets. To be successful, the user must have access to the source and at least one folder in the source. Affected versions are: 24.0.0 through 24.3.0, 23.0.0 through 23.2.3, and 22.0.0 through 22.2.2. Fixed versions are: 24.3.1 and later, 23.2.4 and later, and 22.2.3 and later.
Weakness: CWE-22
Which versions are affected by CVE-2024-23768?
1 open source package ship an affected version, including dremio. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
dremio Bitnami | From 22.0.0 | 22.2.3, 23.2.4, 24.3.1 |
Products include Dremio Dremio.
How do I fix CVE-2024-23768?
Upgrade dremio to a fixed version for your release line: 22.2.3, 23.2.4 or 24.3.1.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-23768 being exploited?
There is no known exploitation of CVE-2024-23768 in the wild and no public exploit code.
Sources
Also known as BIT-dremio-2024-23768, GHSA-rgc3-75gq-ph6c.