CVE-2024-12866

HIGH

7.5

Beschreibung

A local file inclusion vulnerability exists in netease-youdao/qanything version v2.0.0. This vulnerability allows an attacker to read arbitrary files on the file system, which can lead to remote code execution by retrieving private SSH keys, reading private files, source code, and configuration files.

CVE Details

CVSS v3.1 Bewertung7.5

SchweregradHIGH

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienNONE

BenutzerinteraktionNONE

Veroffentlicht3/20/2025

Zuletzt geandert8/1/2025

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

youdao:qanything

Schwachen (CWE)

CWE-22

Referenzen

https://huntr.com/bounties/c23da7c7-a226-40a2-83db-6a8ab1b2ef64(security@huntr.dev)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.