CVE-2024-33369
Published: 27 September 2024
Summary
CVE-2024-33369 is a high-severity Path Traversal (CWE-22) vulnerability in Plasmoapp Rpshare. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 10.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-33369 is a directory traversal vulnerability in the Plasmoapp RPShare Fabric mod version 1.0.0. The flaw resides in the getFileNameFromConnection method of the DownloadTask component and is tracked under CWE-22. It received a CVSS 3.1 score of 8.8 reflecting network attack vector, low complexity, and no required privileges beyond user interaction.
A remote attacker can exploit the issue over the network to traverse directories and execute arbitrary code on the affected system, resulting in full impacts to confidentiality, integrity, and availability.
The associated EPSS score rose from lower values to a peak of 0.0858 before receding to the current 0.0464, indicating a period of increased exploitation interest after disclosure. Public references consist of a technical gist and the project's GitHub repository.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-31111
Vulnerability details
Directory Traversal vulnerability in Plasmoapp RPShare Fabric mod v.1.0.0 allows a remote attacker to execute arbitrary code via the getFileNameFromConnection method in DownloadTask
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.