CVE-2024-46898

EUVD-2024-42142
SHIRASAGI prior to v1.19.1 processes URLs in HTTP requests improperly, resulting in a path traversal vulnerability. If this vulnerability is exploited, arbitrary files on the server may be retrieved when processing crafted HTTP requests.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
jpcertCNA
8.6 HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 75%
Affected Products (NVD)
VendorProductVersion
ss-projshirasagi
𝑥
< 1.19.1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/shirasagi/shirasagi/commit/5ac4685d7e4330f949f13219069107fc5d768934
https://jvn.jp/en/jp/JVN58721679/
https://www.ss-proj.org/