CVE-2024-23334

CVSS 3.1 Score 7.5 of 10 (high)

Details

Published Jan 29, 2024
Updated: Feb 9, 2024
CWE ID 22

Summary

CVE-2024-23334 is a vulnerability affecting the aiohttp framework, an asynchronous HTTP client/server framework for asyncio and Python. This vulnerability allows for directory traversal attacks, potentially leading to unauthorized access to arbitrary files on the system. The issue arises when configuring static routes and specifying the root path for static files. When the 'follow_symlinks' option is set to True, there is no validation to ensure that file reading stays within the root directory, even when symbolic links are not present. To remediate this vulnerability, it is recommended to disable 'follow_symlinks' and use a reverse proxy. A fix for this issue is available in version 3.9.2 of aiohttp. The potential danger of this vulnerability lies in the unauthorized access it enables, posing a high risk to organizations' confidentiality and potentially leading to data breaches or further compromise of the system.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2024-23334 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options