CVE-2024-3078
A vulnerability was found in Qdrant up to 1.6.1/1.7.4/1.8.2 and classified as critical.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.87%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A vulnerability was found in Qdrant up to 1.6.1/1.7.4/1.8.2 and classified as critical. This issue affects some unknown processing of the file lib/collection/src/collection/snapshots.rs of the component Full Snapshot REST API. The manipulation leads to path traversal. Upgrading to version 1.8.3 is able to address this issue. The patch is named 3ab5172e9c8f14fa1f7b24e7147eac74e2412b62. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-258611.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.87% probability · 57th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- qdrant/qdrant
- Source
- cna@vuldb.com
References
- https://github.com/qdrant/qdrant/commit/3ab5172e9c8f14fa1f7b24e7147eac74e2412b62Patch
- https://github.com/qdrant/qdrant/pull/3856Issue Tracking, Patch
- https://github.com/qdrant/qdrant/releases/tag/v1.8.3Release Notes
- https://vuldb.com/?ctiid.258611Permissions Required, VDB Entry
- https://vuldb.com/?id.258611Third Party Advisory, VDB Entry
- https://github.com/qdrant/qdrant/commit/3ab5172e9c8f14fa1f7b24e7147eac74e2412b62Patch
- https://github.com/qdrant/qdrant/pull/3856Issue Tracking, Patch
- https://github.com/qdrant/qdrant/releases/tag/v1.8.3Release Notes
- https://vuldb.com/?ctiid.258611Permissions Required, VDB Entry
- https://vuldb.com/?id.258611Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.