Cyber Resilience

CVE-2024-25828

MediumPublic PoC

Published: 22 February 2024

Published
22 February 2024
Modified
03 April 2025
KEV Added
—
Patch
—
CVSS Score v3.1 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
EPSS Score 0.0016 37.1th percentile
Risk Priority 10 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-25828 is a medium-severity Path Traversal: 'dir/../../filename' (CWE-27) vulnerability in Cmseasy Cmseasy. Its CVSS base score is 4.9 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 37.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability details

cmseasy V7.7.7.9 has an arbitrary file deletion vulnerability in lib/admin/template_admin.php.

CWE(s)
CWE-27

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1070.004 File Deletion Stealth
Adversaries may delete files left behind by the actions of their intrusion activity.
attack.mitre.org →
T1485 Data Destruction Impact
Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources.
attack.mitre.org →
Why these techniques?

Arbitrary file deletion in a public-facing web application (CMSEasy admin panel) enables exploitation of public-facing apps (T1190), file deletion for indicator removal (T1070.004), general file deletion for impact (T1107), and data destruction (T1485).

Affected Assets

cmseasy
cmseasy
7.7.7.9

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References