CVE-2024-51483CWE-22

changedetection.io Path Traversal vulnerability

Medium · published November 1, 2024

CVSS v4.0
6.9
EPSS
2%
Percentile
83.0
In the wild
Unconfirmed
What it is

changedetection.io is free, open source web page change detection software. Prior to version 0.47.5, when a WebDriver is used to fetch files, `source:file:///etc/passwd` can be used to retrieve local system files, where the more traditional `file:///etc/passwd` gets blocked. Version 0.47.5 fixes the issue.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.02274 · 83.0th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2024-11-01T16:19Z
EPSS history
Timeline
  • 01 NOV 16:19Z
    changedetection.io Path Traversal vulnerability
    cvelistv5