VulnerabilityAnalyzed

CVE-2024-11215

Absolute path traversal (incorrect restriction of a path to a restricted directory) vulnerability in the EasyPHP web server, affecting version 14.1.

MEDIUM 6.5EPSS 0.76%

Does this matter?

Lower severity and a low EPSS score (0.76%). Track it; it rarely justifies an emergency change on its own.

Description

Absolute path traversal (incorrect restriction of a path to a restricted directory) vulnerability in the EasyPHP web server, affecting version 14.1. This vulnerability could allow remote users to bypass SecurityManager restrictions and retrieve any file stored on the server by setting only consecutive strings ‘/...%5c’.

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.76% probability · 53th percentile
CISA KEV: Not listed
Weakness: CWE-22
Affected: easyphp/webserver
Source: cve-coordination@incibe.es

References

https://www.incibe.es/en/incibe-cert/notices/aviso/path-traversal-vulnerability-easyphpThird Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.