CVE-2024-11238

MEDIUMNuclei

Landray EKP sysUiComponent.do delPreviewFile path traversal

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-11238 has a selected CVSS score of 6.9 (medium); EIP currently links 1 Nuclei template.

Description

A vulnerability, which was classified as critical, was found in Landray EKP up to 16.0. This affects the function delPreviewFile of the file /sys/ui/sys_ui_component/sysUiComponent.do?method=delPreviewFile. The manipulation of the argument directoryPath leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · May 9, 2025 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Nov 15, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

EKP

Browse Landray / EKP
CVE List16.0affected

landray_ekp

Browse landray / landray_ekp

Default status: unknown

CVE List, VulnCheck16.0affected

Nuclei templates

1
ProjectDiscoveryMEDIUMLandray EKP - Path TraversalCVSS 6.5

A vulnerability, which was classified as critical, was found in Landray EKP up to 16.0. This affects the function delPreviewFile of the file /sys/ui/sys_ui_component/sysUiComponent.do?method=delPreviewFile. The manipulation of the argument directoryPath leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Impact

Remote attackers can access arbitrary files on the server, potentially leading to information disclosure or system compromise.

Remediation

Update to the latest version that addresses this vulnerability or apply appropriate patches.

WeaknessesCWE-22
Authorstheamanrawat
Template tagscvecve2024lfiintrusivevkev
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CPE: cpe:2.3:a:landray:landray_ekp:*:*:*:*:*:*:*:*
Shodan: http.favicon.hash:831854882
https://github.com/CoinIsMoney/TempGuide/blob/main/LL-exp-02.pdf https://nvd.nist.gov/vuln/detail/CVE-2024-11238 https://vuldb.com/?ctiid.284673

Source: ProjectDiscovery

References

5