CVE-2024-11239
CVSS 3.1 Score 5.4 of 10 (medium)
Details
Published Nov 15, 2024
CWE ID 22
Summary
CVE-2024-11239 is a newly disclosed critical vulnerability affecting Landray EKP versions up to 16.0. The issue lies within the API Interface's deleteFile function of the /sys/common/import.do?method=deleteFile component. The vulnerability enables path traversal by maliciously manipulating the argument folder. An attacker can exploit this remotely, making the threat significant. Unfortunately, the exploit for this vulnerability has been made public, increasing the risk. The vendor was notified of the disclosure but failed to respond.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- EKP