CVE-2024-34490 Path traversal in n/a
Local attackers can exploit predictable temporary file names in Maxima's plotting features to execute arbitrary code or escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-34490?
CVE-2024-34490 is a medium-severity path traversal vulnerability in n/a, published on 5 May 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In Maxima through 5.47.0 before 51704c, the plotting facilities make use of predictable names under /tmp. Thus, the contents may be controlled by a local attacker who can create files in advance with these names. This affects, for example, plot2d.
Weakness: CWE-377
Which versions are affected by CVE-2024-34490?
How do I fix CVE-2024-34490?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-34490 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-34490 exists.
Sources
Also known as DEBIAN-CVE-2024-34490, GHSA-gpc9-w434-fvwx, UBUNTU-CVE-2024-34490.