CVE-2024-41922
Published: 03 October 2024
Summary
CVE-2024-41922 is a high-severity Path Traversal (CWE-22) vulnerability in Veertu Anka Build Cloud. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 9.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2024-41922 is a directory traversal vulnerability, tracked under CWE-22, that affects the log files download functionality in Veertu Anka Build version 1.42.0. The flaw permits an attacker to supply a specially crafted HTTP request that discloses sensitive information from the underlying file system, carrying a CVSS 3.1 base score of 7.5 reflecting network attack vector, low complexity, and no required authentication or user interaction.
An unauthenticated remote attacker can exploit the issue simply by sending a malicious request to the affected download endpoint, resulting in unauthorized access to arbitrary files and potential exposure of credentials, configuration data, or other sensitive artifacts stored on the server.
Public advisories from Talos Intelligence (TALOS-2024-2061) provide further technical detail at the referenced URLs. The EPSS score remains flat at 0.0524 with no observed rise after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-39275
Vulnerability details
A directory traversal vulnerability exists in the log files download functionality of Veertu Anka Build 1.42.0. A specially crafted HTTP request can lead to a disclosure of sensitive information. An attacker can make an unauthenticated HTTP request to trigger this…
more
vulnerability.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.