CVE-2024-25154

MEDIUM

5.3

Description

Improper URL validation leads to path traversal in FileCatalyst Direct 3.8.8 and earlier allowing an encoded payload to cause the web server to return files located outside of the web root which may lead to data leakage.

CVE Details

CVSS v3.1 Score5.3

SeverityMEDIUM

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published3/13/2024

Last Modified1/21/2025

Sourcenvd

Honeypot Sightings0

Affected Products

fortra:filecatalyst_direct

Weaknesses (CWE)

CWE-22CWE-22

References

https://filecatalyst.software/public/filecatalyst/Direct/3.8.9.90/whatsnew_direct.html(df4dee71-de3a-4139-9588-11b62fe6c0ff)

https://www.fortra.com/security/advisory/fi-2024-003(df4dee71-de3a-4139-9588-11b62fe6c0ff)

https://filecatalyst.software/public/filecatalyst/Direct/3.8.9.90/whatsnew_direct.html(af854a3a-2127-422b-91ae-364da2661108)

https://www.fortra.com/security/advisory/fi-2024-003(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.