CVE-2024-41628

HIGHNuclei

Cluster Control CMON API - Directory Traversal

Title source: github.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2024-41628 has a selected CVSS score of 7.5 (high); EIP currently links 1 repository PoC and 1 Nuclei template.

Description

Directory Traversal vulnerability in Severalnines Cluster Control 1.9.8 before 1.9.8-9778, 2.0.0 before 2.0.0-9779, and 2.1.0 before 2.1.0-9780 allows a remote attacker to include and display file content in an HTTP request via the CMON API.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 30, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

clustercontrol

Browse severalnines / clustercontrol

Default status: unknown

CVE List1.9.8 to < 1.9.8-9778affected
2.0.0 to < 2.0.0-9779affected
2.1.0 to < 2.1.0-9780affected

Proofs of concept

1

Repository PoCs

GitHubRedshift-CyberSecurity/CVE-2024-41628Repository PoCby Redshift-CyberSecurity2Not analyzed2 files

2.7 KiB

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryHIGHCluster Control CMON API - Directory TraversalCVSS 7.5

Directory Traversal vulnerability in Severalnines Cluster Control 1.9.8 before 1.9.8-9778, 2.0.0 before 2.0.0-9779, and 2.1.0 before 2.1.0-9780 allows a remote attacker to include and display file content in an HTTP request via the CMON API.

Impact

Unauthenticated attackers can exploit directory traversal to read arbitrary files from the Cluster Control server.

Remediation

Update Severalnines Cluster Control to version 1.9.8-9778, 2.0.0-9779, or 2.1.0-9780 or later.

WeaknessesCWE-22
Authorss4e-io
Template tagscvecve2024severalninescluster-controllfivuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CPE: cpe:2.3:a:severalnines:clustercontrol:*:*:*:*:*:*:*:*
FOFA: icon_hash="160707013" || icon_hash="-1815707560"
https://cvefeed.io/vuln/detail/CVE-2024-41628 https://github.com/Redshift-CyberSecurity/CVE-2024-41628 https://vuldb.com/?id.272533 https://vulmon.com/vulnerabilitydetails?qid=CVE-2024-41628

Source: ProjectDiscovery

References

6