CVE-2024-11481CWE-22

A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API

High · published November 29, 2024

CVSS v3.1
8.2
EPSS
0%
Percentile
37.4
In the wild
Unconfirmed
What it is

A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API. This leads to improper handling of path traversal, insecure forwarding to an AJP backend without adequate validation, and lack of authentication for accessing internal API endpoints.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00442 · 37.4th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2024-11-29T07:01Z
EPSS history
Timeline
  • 29 NOV 07:01Z
    A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API
    cvelistv5