CVE-2024-41163
Published: 03 October 2024
Summary
CVE-2024-41163 is a high-severity Path Traversal (CWE-22) vulnerability in Veertu Anka Build Cloud. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 1.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2024-41163 is a directory traversal vulnerability in the archive functionality of Veertu Anka Build 1.42.0. The flaw, tracked as CWE-22, permits an unauthenticated remote attacker to submit a specially crafted HTTP request that discloses sensitive information stored on the affected system. It carries a CVSS 3.1 base score of 7.5, reflecting network-accessible exploitation with no required credentials or user interaction.
An attacker can exploit the issue simply by sending a malicious HTTP request to the archive endpoint, bypassing authentication controls and retrieving arbitrary files. This grants read access to confidential data without any other preconditions on the target.
Public advisories from Talos Intelligence (TALOS-2024-2059) document the vulnerability and provide the technical details referenced above. The current EPSS score of 0.6361 has shown no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-38956
Vulnerability details
A directory traversal vulnerability exists in the archive functionality of Veertu Anka Build 1.42.0. A specially crafted HTTP request can lead to a disclosure of sensitive information. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.