Description
NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may lead to remote code execution across the enterprise because PhysicalDiscovery has cleartext credentials).
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
NAKIVO Backup & Replication Director
Default version status: unaffected
0 to < 11.0.0.88174affected
References
- https://labs.watchtowr.com/the-best-security-is-when-we-all-agree-to-keep-everything-secret-except-the-secrets-nakivo-backup-replication-cve-2024-48248/ ↗
- https://helpcenter.nakivo.com/Release-Notes/Content/Release-Notes.htm ↗
- https://github.com/watchtowrlabs/nakivo-arbitrary-file-read-poc-CVE-2024-48248/?ref=labs.watchtowr.com ↗
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-48248 ↗