CVE-2024-4701
Published: 14 May 2024
Summary
CVE-2024-4701 is a critical-severity Path Traversal (CWE-22) vulnerability. Its CVSS base score is 9.9 (Critical).
Operationally, ranked in the top 4.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
A path traversal vulnerability tracked as CVE-2024-4701 affects Netflix Genie in all versions prior to 4.3.18. Classified under CWE-22, the flaw carries a CVSS 3.1 score of 9.9 and stems from insufficient path validation that can be abused to reach arbitrary files or execute code on the host.
An attacker with low privileges can trigger the issue remotely over the network with low attack complexity and no user interaction. Successful exploitation yields high confidentiality and integrity impact plus limited availability effects because the vulnerability crosses security boundaries on the affected system.
The Netflix security bulletin published at https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2024-001.md addresses mitigation and directs users to upgrade to Genie 4.3.18 or later. The associated EPSS values have remained near 0.20 without a pronounced rise after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-1837
Vulnerability details
A path traversal issue potentially leading to remote code execution in Genie for all versions prior to 4.3.18
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.