CVE-2024-11833CWE-22

Arbitrary Directory Write via Runbooks Artifact Upload

High · published December 13, 2024

CVSS v4.0
8.9
EPSS
1%
Percentile
42.2
In the wild
Unconfirmed
What it is

⚡ A sneaky path traversal flaw in PlexTrac means attackers can write arbitrary files to your system — that's like giving someone a key to your file cabinet without checking their ID! 🔑 Think of it like a restaurant where the kitchen staff can access any room in the building because nobody checks their access passes. This flaw in PlexTrac allows unauthorized users to place files wherever they please, like a chef suddenly serving food from the manager's office. This means a malicious actor could overwrite important files, inject harmful scripts, or even plant backdoors! If an unauthorized user gains access, the potential for damage is absolutely devastating — they could compromise your entire system!

Put simply

Think of it like a restaurant where the kitchen staff can access any room in the building because nobody checks their access passes. This flaw in PlexTrac allows unauthorized users to place files wherever they please, like a chef suddenly serving food from the manager's office. This vulnerability in PlexTrac allows attackers to bypass directory restrictions and write files anywhere in the server’s filesystem, essentially ignoring the intended access controls. It affects versions from 1.61.3 up to, but not including, 2.8.1.

What to do

This means a malicious actor could overwrite important files, inject harmful scripts, or even plant backdoors! If an unauthorized user gains access, the potential for damage is absolutely devastating — they could compromise your entire system! To protect your system, immediately upgrade PlexTrac to version 2.8.1 or later. Additionally, review your file permission settings to ensure proper restrictions are in place and monitor for any suspicious activity. You've got this! Follow these steps, and you'll have your PlexTrac secure in no time. 🛡️

The record
Technical detail
CVSS v4.0
8.9 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N/U:Red
EPSS
0.00504 · 42.2th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2024-12-13T05:49Z
EPSS history
Timeline
  • 13 DEC 05:49Z
    Arbitrary Directory Write via Runbooks Artifact Upload
    cvelistv5