CVE-2024-11944
CVSS 3.0 Score 7.5 of 10 (high)
Details
Published Dec 30, 2024
CWE ID 22
Summary
CVE-2024-11944 is a newly disclosed vulnerability in iXsystems TrueNAS CORE, which affects tarfile.extractall method. The issue arises due to insufficient validation of user-supplied paths, enabling directory traversal attacks. With no authentication required, network-adjacent attackers can take advantage of this Remote Code Execution (RCE) vulnerability, gaining root access to targeted TrueNAS installations. This flaw, identified as ZDI-CAN-25626, can be combined with other vulnerabilities to execute arbitrary code.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.