CVE-2024-48766
13.05.2025, 16:15
NetAlertX 24.7.18 before 24.10.12 allows unauthenticated file reading because an HTTP client can ignore a redirect, and because of factors related to strpos and directory traversal, as exploited in the wild in May 2025. This is related to components/logs.php.
| Vendor | Product | Version |
|---|---|---|
| netalertx | netalertx | 24.7.18 ≤ 𝑥 < 24.10.12 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-698 - Execution After Redirect (EAR)The web application sends a redirect to another location, but instead of exiting, it executes additional code.
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.