CVE-2024-0882

CVSS 3.1 Score 7.5 of 10 (high)

Details

Published Jan 25, 2024
Updated: May 17, 2024
CWE ID 24
CWE ID 22

Summary

CVE-2024-0882 is a newly disclosed vulnerability affecting the qwdigital LinkWechat 5.1.0 software. This issue, classified as problematic, lies in the Universal Download Interface component's /linkwechat-api/common/download/resource file path. An attacker can exploit a path traversal vulnerability by manipulating the argument name with the input /profile/../../../../../etc/passwd, leading to a potential file disclosure. The exploit for this vulnerability has been made public, increasing the risk of remote attacks. Vendors were contacted about the disclosure but did not respond, leaving users potentially vulnerable.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share