{"dataType": "CVE_RECORD", "dataVersion": "5.0", "cveMetadata": {"cveId": "CVE-2024-23822", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-01-22T22:23:54.337Z", "datePublished": "2024-01-29T15:46:30.188Z", "dateUpdated": "2024-01-29T15:46:30.188Z"}, "containers": {"cna": {"title": "Thruk Incorrect limitation of a pathname to a restricted directory (Path Traversal) (CWE-22)", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/sni/Thruk/security/advisories/GHSA-4mrh-mx7x-rqjx", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/sni/Thruk/security/advisories/GHSA-4mrh-mx7x-rqjx"}, {"name": "https://github.com/sni/Thruk/commit/1aa9597cdf2722a69651124f68cbb449be12cc39", "tags": ["x_refsource_MISC"], "url": "https://github.com/sni/Thruk/commit/1aa9597cdf2722a69651124f68cbb449be12cc39"}], "affected": [{"vendor": "sni", "product": "Thruk", "versions": [{"version": "< 3.12", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-01-29T15:46:30.188Z"}, "descriptions": [{"lang": "en", "value": "Thruk is a multibackend monitoring webinterface. Prior to 3.12, the Thruk web monitoring application presents a vulnerability in a file upload form that allows a threat actor to arbitrarily upload files to the server to any path they desire and have permissions for. This vulnerability is known as Path Traversal or Directory Traversal. Version 3.12 fixes the issue.\n"}], "source": {"advisory": "GHSA-4mrh-mx7x-rqjx", "discovery": "UNKNOWN"}}}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:thruk:thruk:*:*:*:*:*:*:*:*", "matchCriteriaId": "1BA8DF0F-A05A-4BAA-840F-F4CEF38641E0", "versionEndExcluding": "3.12", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Thruk is a multibackend monitoring webinterface. Prior to 3.12, the Thruk web monitoring application presents a vulnerability in a file upload form that allows a threat actor to arbitrarily upload files to the server to any path they desire and have permissions for. This vulnerability is known as Path Traversal or Directory Traversal. Version 3.12 fixes the issue.\n"}, {"lang": "es", "value": "Thruk es una interfaz web de monitoreo multibackend. Antes de la versi\u00f3n 3.12, la aplicaci\u00f3n de monitoreo web Thruk presenta una vulnerabilidad en un formulario de carga de archivos que permite a un actor de amenazas cargar archivos arbitrariamente al servidor en cualquier ruta que desee y para la que tenga permisos. Esta vulnerabilidad se conoce como Path Traversal o Directory Traversal. La versi\u00f3n 3.12 soluciona el problema."}], "id": "CVE-2024-23822", "lastModified": "2024-02-05T18:04:52.843", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2024-01-29T16:15:09.437", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/sni/Thruk/commit/1aa9597cdf2722a69651124f68cbb449be12cc39"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Patch", "Vendor Advisory"], "url": "https://github.com/sni/Thruk/security/advisories/GHSA-4mrh-mx7x-rqjx"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}