CVE-2024-0550
CVSS 3.1 Score 6.5 of 10 (medium)
Details
Published Feb 28, 2024
Updated: Jan 10, 2025
CWE ID 23
Summary
CVE-2024-0550 is a vulnerability that allows privileged users, specifically those with `manager` or `admin` status, to set their profile picture using a relative filepath. Once the profile picture is set, the user can then leverage the PFP GET API to download any valid files on the system. This issue poses a risk as it requires an attacker to initially have privileged permissions to exploit it.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Vendors
- Mintplex Labs