CVE-2024-11312

CRITICAL

DVC 6.0-<6.4 - Unauthenticated Path Traversal and Arbitrary File Write

Title source: llm
STIX 2.1

Description

The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to upload arbitrary files to any directory, leading to arbitrary code execution by uploading webshells.

References (2)

Core 2
Core References
Third Party Advisory third-party-advisory
https://www.twcert.org.tw/tw/cp-132-8248-8dac9-1.html
Third Party Advisory third-party-advisory
https://www.twcert.org.tw/en/cp-139-8249-65252-2.html

Scores

CVSS v3 9.8
EPSS 0.0134
EPSS Percentile 67.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-22 CWE-434 CWE-23
Status published
Products (1)
trcore/dvc 6.0 - 6.4
Published Nov 18, 2024
Tracked Since Feb 18, 2026