CVE-2024-31978CWE-22

A vulnerability has been identified in SINEC NMS (All versions < V2.0 SP2)

High · published April 9, 2024

CVSS v3.1
7.6
EPSS
0%
Percentile
39.2
In the wild
Unconfirmed
What it is

A vulnerability has been identified in SINEC NMS (All versions < V2.0 SP2). Affected devices allow authenticated users to export monitoring data. The corresponding API endpoint is susceptible to path traversal and could allow an authenticated attacker to download files from the file system. Under certain circumstances the downloaded files are deleted from the file system.

The record
Technical detail
CVSS v3.1
7.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H/E:P/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.00464 · 39.2th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2024-04-09T08:34Z
EPSS history
Timeline
  • 09 APR 08:34Z
    A vulnerability has been identified in SINEC NMS (All versions < V2.0 SP2)
    cvelistv5