CVE-2024-34313
Published: 24 June 2024
Summary
CVE-2024-34313 is a critical-severity Path Traversal (CWE-22) vulnerability. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 3.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-34313 is a directory traversal vulnerability, tracked as CWE-22, that affects the VPL Jail System in versions up to 4.0.2. The flaw permits an attacker to supply a crafted request to a public endpoint and traverse directories outside the intended scope, carrying a CVSS 3.1 base score of 9.8 that reflects network attack vector, low complexity, and no required privileges or user interaction.
An unauthenticated remote attacker can therefore read or write arbitrary files on the affected system, resulting in complete loss of confidentiality, integrity, and availability. Because the endpoint is publicly reachable, exploitation requires only the ability to send HTTP requests to the VPL Jail System instance.
Public proof-of-concept code has been published on GitHub, and the EPSS score currently stands at 0.247 with an identical peak value, indicating moderate and stable exploitation probability since disclosure. No vendor advisory or patch information is referenced in the available sources.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-34722
Vulnerability details
An issue in VPL Jail System up to v4.0.2 allows attackers to execute a directory traversal via a crafted request to a public endpoint.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.