CVE-2024-0849CWE-22

Leanote 2.7.0 - Local File Read

Medium · published February 7, 2024

CVSS v3.1
5.0
EPSS
0%
Percentile
13.5
In the wild
Unconfirmed
What it is

Leanote version 2.7.0 allows obtaining arbitrary local files. This is possible because the application is vulnerable to LFR.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00234 · 13.5th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2024-02-07T02:50Z
EPSS history
Timeline
  • 07 FEB 02:50Z
    Leanote 2.7.0 - Local File Read
    cvelistv5