VulnerabilityDeferred

CVE-2024-54452

A Directory Traversal and Local File Inclusion vulnerability in the logsSys.do page allows remote attackers (authenticated as administrators) to trigger the display of unintended files.

MEDIUM 4.9EPSS 0.84%

Does this matter?

Lower severity and a low EPSS score (0.84%). Track it; it rarely justifies an emergency change on its own.

Description

An issue was discovered in Kurmi Provisioning Suite before 7.9.0.35 and 7.10.x through 7.10.0.18. A Directory Traversal and Local File Inclusion vulnerability in the logsSys.do page allows remote attackers (authenticated as administrators) to trigger the display of unintended files. Any file accessible to the Kurmi user account could be displayed, e.g., configuration files with information such as the database password.

CVSS 3.1: 4.9 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.84% probability · 56th percentile
CISA KEV: Not listed
Weakness: CWE-22
Source: cve@mitre.org

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.