CVE-2024-45241

Deeper analysis

CVE-2024-45241 is a path traversal vulnerability in the GeneralDocs.aspx endpoint of CentralSquare CryWolf, a false alarm management solution, affecting all versions through August 9, 2024. The flaw resides in the handling of the rpt parameter, which fails to properly sanitize input and permits access to files outside the application's web root directory, resulting in unauthorized disclosure of sensitive information. The issue carries a CVSS 3.1 score of 7.5 and is classified under CWE-22.

Unauthenticated remote attackers can exploit the vulnerability over the network by supplying crafted values to the rpt parameter in requests to GeneralDocs.aspx. Successful exploitation grants read access to arbitrary files on the underlying server, potentially exposing configuration data, credentials, or other sensitive material without requiring authentication or user interaction.

The current EPSS score of 0.9083, with a recorded peak of 0.9129, indicates a high likelihood of exploitation. Public references include a technical analysis and proof-of-concept repository detailing the traversal technique, along with the vendor product page, though no official patch or mitigation guidance is referenced in available sources.