{"id":"CVE-2024-25154","state":"PUBLISHED","title":"Path Traversal in FileCatalyst Direct 3.8.8 and Earlier","description":"Improper URL validation leads to path traversal in FileCatalyst Direct 3.8.8 and earlier allowing an encoded payload to cause the web server to return files located outside of the web root which may lead to data leakage.  ","publishedAt":"2024-03-13T14:13:56.214Z","updatedAt":"2024-08-12T18:55:44.054Z","severity":{"score":5.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","source":"Fortra"},"assigner":"Fortra","products":["Fortra FileCatalyst"],"affected":[{"vendor":"Fortra","product":"FileCatalyst","defaultStatus":"unaffected","versions":[{"version":"3.8.6 ","status":"affected","lessThan":"3.8.9","versionType":"semver"}],"modules":["Direct"]}],"references":["https://www.fortra.com/security/advisory/fi-2024-003","https://filecatalyst.software/public/filecatalyst/Direct/3.8.9.90/whatsnew_direct.html"],"weaknesses":["CWE-22"],"ingestedAt":"2026-10-29T20:07:10.607Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/25xxx/CVE-2024-25154.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-25154","state":"PUBLISHED","datePublished":"2024-03-13T14:13:56.214Z","dateUpdated":"2024-08-12T18:55:44.054Z","assignerShortName":"Fortra","assignerOrgId":"df4dee71-de3a-4139-9588-11b62fe6c0ff","dateReserved":"2024-02-06T21:23:57.925Z"},"containers":{"cna":{"title":"Path Traversal in FileCatalyst Direct 3.8.8 and Earlier","descriptions":[{"lang":"en","value":"Improper URL validation leads to path traversal in FileCatalyst Direct 3.8.8 and earlier allowing an encoded payload to cause the web server to return files located outside of the web root which may lead to data leakage.  "}],"affected":[{"vendor":"Fortra","product":"FileCatalyst","defaultStatus":"unaffected","versions":[{"version":"3.8.6 ","status":"affected","lessThan":"3.8.9","versionType":"semver"}],"modules":["Direct"]}],"references":[{"url":"https://www.fortra.com/security/advisory/fi-2024-003"},{"url":"https://filecatalyst.software/public/filecatalyst/Direct/3.8.9.90/whatsnew_direct.html"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-22","description":"CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Fortra","orgId":"df4dee71-de3a-4139-9588-11b62fe6c0ff","dateUpdated":"2024-03-13T14:13:56.214Z"},"impacts":[{"capecId":"CAPEC-139","descriptions":[{"lang":"en","value":"CAPEC-139 Relative Path Traversal"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"\n\n<span style=\"background-color: rgb(255, 255, 255);\">Upgrade FileCatalyst to version 3.8.9 or later to remediate the path traversal vulnerability.</span>\n\n<br>"}],"value":"\nUpgrade FileCatalyst to version 3.8.9 or later to remediate the path traversal vulnerability.\n\n\n"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.fortra.com/security/advisory/fi-2024-003","tags":["x_transferred"]},{"url":"https://filecatalyst.software/public/filecatalyst/Direct/3.8.9.90/whatsnew_direct.html","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T23:36:21.762Z"}},{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"fortra","product":"filecatalyst","defaultStatus":"unaffected","versions":[{"version":"3.8.6","status":"affected","lessThan":"3.8.9","versionType":"semver"}],"cpes":["cpe:2.3:a:fortra:filecatalyst:*:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-03-13T20:08:47.135964Z","id":"CVE-2024-25154","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-08-12T18:55:44.054Z"}}]}}}