CVE-2024-37372

The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be ignored, which is not always true

Low · published January 9, 2025

CVSS v3.0
3.6
EPSS
0%
Percentile
40.7
In the wild
Unconfirmed
What it is

The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases.

The record
Technical detail
CVSS v3.0
3.6 · LOW
Vector
CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00488 · 40.7th percentile
Published
2025-01-09T00:33Z
EPSS history
Timeline
  • 09 JAN 00:33Z
    The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be ignored, which is not always true
    cvelistv5