CVE-2024-11215

MEDIUM

6.5

Descripcion

Absolute path traversal (incorrect restriction of a path to a restricted directory) vulnerability in the EasyPHP web server, affecting version 14.1. This vulnerability could allow remote users to bypass SecurityManager restrictions and retrieve any file stored on the server by setting only consecutive strings ‘/...%5c’.

Detalles CVE

Puntuacion CVSS v3.16.5

SeveridadMEDIUM

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosLOW

Interaccion usuarioNONE

Publicado11/14/2024

Ultima modificacion1/7/2026

Fuentenvd

Avistamientos honeypot0

Productos afectados

easyphp:webserver

Debilidades (CWE)

CWE-22

Referencias

https://www.incibe.es/en/incibe-cert/notices/aviso/path-traversal-vulnerability-easyphp(cve-coordination@incibe.es)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.