CVE-2024-39332 Path traversal in n/a
Remote attackers can modify client-side JavaScript to achieve path traversal, potentially leading to remote code execution by altering server shell scripts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-39332?
CVE-2024-39332 is a critical path traversal vulnerability in n/a, published on 31 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Webswing 23.2.2 allows remote attackers to modify client-side JavaScript code to achieve path traversal, likely leading to remote code execution via modification of shell scripts on the server.
Weakness: CWE-22
Which versions are affected by CVE-2024-39332?
It affects 1 product.
Products include Webswing Webswing.
How do I fix CVE-2024-39332?
No fix has been published for CVE-2024-39332 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-39332 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-39332 exists.
Other vulnerabilities in n/a
Sources
Also known as GHSA-635w-qqhj-gvhx.