Cyber Resilience

CVE-2024-40348

High

Published: 20 July 2024

Published
20 July 2024
Modified
08 July 2025
KEV Added
—
Patch
—
CVSS Score v3.1 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
EPSS Score 0.9338 99.8th percentile
Risk Priority 72 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-40348 is a high-severity Path Traversal (CWE-22) vulnerability in Bazarr Bazarr. Its CVSS base score is 8.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked in the top 0.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

CVE-2024-40348 is a directory traversal vulnerability, tracked as CWE-22, that affects the /api/swaggerui/static component of Bazaar version 1.4.3. It carries a CVSS 3.1 base score of 8.2 reflecting network attack vector, low attack complexity, and no required privileges or user interaction, with high confidentiality impact and limited availability impact.

Unauthenticated remote attackers can exploit the flaw to traverse directories on the affected system and read arbitrary files, achieving unauthorized access to sensitive data without authentication.

The two provided references consist solely of public proof-of-concept material demonstrating the traversal via crafted filenames; they contain no vendor advisories, patches, or mitigation guidance. The associated EPSS score remains high at a current value of 0.9338 with a peak of 0.9360.

EU & UK References

Vulnerability details

An issue in the component /api/swaggerui/static of Bazaar v1.4.3 allows unauthenticated attackers to execute a directory traversal.

CWE(s)
CWE-22

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
T1552.001 Credentials In Files Credential Access
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.
attack.mitre.org →
T1083 File and Directory Discovery Discovery
Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Unauthenticated directory traversal in public-facing /api/swaggerui/static endpoint enables exploitation of public-facing application (T1190), file and directory discovery (T1083), collection of data from local system (T1005), and unsecured credentials in files (T1081).

Affected Assets

bazarr
bazarr
≤ 1.4.3

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SI-10 Information Input Validation
addresses: CWE-22

Validates pathnames and filenames to prevent traversal outside intended directories.

References