CVE-2024-58396YouDataSum CPAS Audit Management System V4 Path Traversal via downPlugs fileId

Beschreibung

YouDataSum CPAS Audit Management System V4 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the fileId parameter. Attackers can send GET requests to /cpasm4/plugInManController/downPlugs with ../ sequences in fileId to retrieve system files like /etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-01-13.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• GitHub PoC (1) exploit
• GitHub PoC (2) exploit
• Nuclei Template technical-description
• Vendor Homepage product
• VulnCheck Advisory: YouDataSum CPAS Audit Management System V4 Path Traversal via downPlugs fileId third-party-advisory