CVE-2024-46898

SHIRASAGI prior to v1.19.1 processes URLs in HTTP requests improperly, resulting in a path traversal vulnerability. If this vulnerability is exploited, arbitrary files on the server may be retrieved when processing crafted HTTP requests.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
jpcertCNA
8.6 HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 63%
VendorProductVersion
ss-projshirasagi
𝑥
< 1.19.1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/shirasagi/shirasagi/commit/5ac4685d7e4330f949f13219069107fc5d768934
https://jvn.jp/en/jp/JVN58721679/
https://www.ss-proj.org/