CVE-2024-38878 Path traversal in Omnivise T3000 Application Server R9.2
Authenticated attackers can exploit a path traversal vulnerability in the diagnostics export API to download arbitrary files from the system.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-38878?
CVE-2024-38878 is a medium-severity path traversal vulnerability in Siemens Omnivise T3000 Application Server R9.2, published on 2 Aug 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A vulnerability has been identified in Omnivise T3000 Application Server R9.2 (All versions), Omnivise T3000 R8.2 SP3 (All versions), Omnivise T3000 R8.2 SP4 (All versions). Affected devices allow authenticated users to export diagnostics data. The corresponding API endpoint is susceptible to path traversal and could allow an authenticated attacker to download arbitrary files from the file system.
Weakness: CWE-22
Which versions are affected by CVE-2024-38878?
It affects 1 product.
Products include Siemens Omnivise T3000 Application Server.
How do I fix CVE-2024-38878?
No fix has been published for CVE-2024-38878 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-38878 being exploited?
There is no known exploitation of CVE-2024-38878 in the wild and no public exploit code.
Other vulnerabilities in Siemens Omnivise T3000 Application Server R9.2
Sources
Also known as GHSA-6cjc-w4j3-jjh8.