CVE-2024-11992
Last modified
CVE-2024-11992 is a critical-severity vulnerability rated 9.1/10 on the CVSS scale. Absolute path traversal vulnerability in Quick.CMS, version 6.7, the exploitation of which could allow remote users to bypass the intended restrictions and download any file if it has the appropriate permissions outside of documentroot configured on the server via the aDirFiles%5B0%5D parameter in the admin.php page. This vulnerability allows an attacker to delete files stored on the server due to a lack of proper verification of user-supplied input.. EPSS estimates a 0.81% chance of exploitation in the next 30 days.
Description
Absolute path traversal vulnerability in Quick.CMS, version 6.7, the exploitation of which could allow remote users to bypass the intended restrictions and download any file if it has the appropriate permissions outside of documentroot configured on the server via the aDirFiles%5B0%5D parameter in the admin.php page. This vulnerability allows an attacker to delete files stored on the server due to a lack of proper verification of user-supplied input.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2024-11992?
How severe is CVE-2024-11992?
How do I fix CVE-2024-11992?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-11984A unrestricted upload of file with dangerous type vulnerabil…9.4
- CVE-2024-11985An improper input validation vulnerability leads to device c…4.4
- CVE-2024-11986Improper input handling in the 'Host Header' allows an unaut…9.6
- CVE-2024-1199A vulnerability has been found in CodeAstro Employee Task Ma…7.5
- CVE-2024-11990A Cross-Site Scripting (XSS) vulnerability in SurgeMail v78c…4.6
- CVE-2024-11991Motoko's incremental garbage collector is impacted by an uni…6.5
- CVE-2024-11993Reflected cross-site scripting (XSS) vulnerability in Lifera…6.1
- CVE-2024-11994APM server logs could contain parts of the document body fro…5.7
- CVE-2024-11995A vulnerability has been found in code-projects Farmacia 1.0…6.1
- CVE-2024-11996A vulnerability was found in code-projects Farmacia 1.0 and …5.4
- CVE-2024-11997A vulnerability was found in code-projects Farmacia 1.0. It …5.4
- CVE-2024-11998A vulnerability was found in code-projects Farmacia 1.0. It …7.5
Are you affected by CVE-2024-11992?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST