CVE-2024-45811
Last modified
CVE-2024-45811 is a medium-severity vulnerability rated 4.8/10 on the CVSS scale. Vite a frontend build tooling framework for javascript. In affected versions the contents of arbitrary files can be returned to the browser. EPSS estimates a 1.03% chance of exploitation in the next 30 days.
Description
Vite a frontend build tooling framework for javascript. In affected versions the contents of arbitrary files can be returned to the browser. `@fs` denies access to files outside of Vite serving allow list. Adding `?import&raw` to the URL bypasses this limitation and returns the file content if it exists. This issue has been patched in versions 5.4.6, 5.3.6, 5.2.14, 4.5.5, and 3.2.11. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Metrics
CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2024-45811?
How severe is CVE-2024-45811?
How do I fix CVE-2024-45811?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-45806Envoy is a cloud-native high-performance edge/middle/service…6.5
- CVE-2024-45807Envoy is a cloud-native high-performance edge/middle/service…7.5
- CVE-2024-45808Envoy is a cloud-native high-performance edge/middle/service…6.5
- CVE-2024-45809Envoy is a cloud-native high-performance edge/middle/service…7.5
- CVE-2024-4581The Slider Revolution plugin for WordPress is vulnerable to …5.4
- CVE-2024-45810Envoy is a cloud-native high-performance edge/middle/service…7.5
- CVE-2024-45812Vite a frontend build tooling framework for javascript. Affe…6.4
- CVE-2024-45813find-my-way is a fast, open source HTTP router, internally u…5.3
- CVE-2024-45815Backstage is an open framework for building developer portal…6.5
- CVE-2024-45816Backstage is an open framework for building developer portal…6.5
- CVE-2024-45817In x86's APIC (Advanced Programmable Interrupt Controller) a…7.3
- CVE-2024-45818The hypervisor contains code to accelerate VGA memory access…6.5
Are you affected by CVE-2024-45811?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST