CVE-2024-25154 MEDIUM

CVE-2024-25154: Path Traversal in FileCatalyst Direct 3.8.8 and Earlier

Vendor Fortra
Product FileCatalyst
Weakness CWE-22 · Path traversal
Published March 13, 2024
Last update August 12, 2024
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Improper URL validation leads to path traversal in FileCatalyst Direct 3.8.8 and earlier allowing an encoded payload to cause the web server to return files located outside of the web root which may lead to data leakage.  

Key dates

02Disclosure timeline

March 13, 2024 CVE published
August 12, 2024 Record updated