CVE-2024-6746

moderate-risk
Published 2024-07-15

A vulnerability classified as problematic was found in NaiboWang EasySpider 0.6.2 on Windows. Affected by this vulnerability is an unknown functionality of the file \EasySpider\resources\app\server.js of the component HTTP GET Request Handler. The manipulation with the input /../../../../../../../../../Windows/win.ini leads to path traversal: '../filedir'. The attack needs to be done within the local network. The exploit has been disclosed to the public and may be used. The identifier VDB-271477 was assigned to this vulnerability. NOTE: The code maintainer explains, that this is not a big issue "because the default is that the software runs locally without going through the Internet".

Do I need to act?

!
80.8% chance of exploitation in next 30 days
EPSS score — higher than 19% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
4
CVSS 4.3/10 Medium
ADJACENT_NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Easyspider

References (8)

Exploit https://github.com/NaiboWang/EasySpider/issues/466
Permissions Required https://vuldb.com/?ctiid.271477
Third Party Advisory https://vuldb.com/?id.271477
Third Party Advisory https://vuldb.com/?submit.371998
Exploit https://github.com/NaiboWang/EasySpider/issues/466
Permissions Required https://vuldb.com/?ctiid.271477
Third Party Advisory https://vuldb.com/?id.271477
Third Party Advisory https://vuldb.com/?submit.371998
40
/ 100
moderate-risk
Severity 15/34 · Moderate
Exploitability 20/34 · Moderate
Exposure 5/34 · Minimal