CVE-2024-34832 Path traversal in n/a
Attackers can execute arbitrary code via crafted file uploads exploiting a directory traversal flaw in CubeCart.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-34832?
CVE-2024-34832 is a critical path traversal vulnerability in n/a, published on 6 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Directory Traversal vulnerability in CubeCart v.6.5.5 and before allows an attacker to execute arbitrary code via a crafted file uploaded to the _g and node parameters.
Weakness: CWE-22
Which versions are affected by CVE-2024-34832?
It affects 1 product.
Products include Cubecart Cubecart.
How do I fix CVE-2024-34832?
No fix has been published for CVE-2024-34832 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-34832 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-34832 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in n/a
Sources
Also known as GHSA-jfv8-vg3m-73pc.