CVE-2024-4836
Published: 02 July 2024
Summary
CVE-2024-4836 is a high-severity Files or Directories Accessible to External Parties (CWE-552) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 1.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Edito CMS versions 3.5 through 3.25 contain an information disclosure vulnerability that permits unauthenticated users to download configuration files from affected web services, exposing sensitive data. The flaw is tracked under CWE-552 and carries a CVSS 3.1 score of 7.5 reflecting network-accessible exploitation with no required credentials or user interaction. The affected code path was eliminated in releases dated 10 January 2014, and all subsequent versions were never impacted.
An attacker with network reachability can directly request the exposed configuration endpoints, retrieving files that contain credentials or other internal settings without authentication. This yields high confidentiality impact while leaving integrity and availability untouched, enabling further targeted attacks against the underlying infrastructure.
CERT.pl advisories note that the issue was resolved by the January 2014 update and recommend that any remaining installations on versions 3.5–3.25 be upgraded immediately to a later release. The current and peak EPSS scores both stand at 0.6370, indicating sustained but not newly emerging exploitation interest since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-44418
- 🇵🇱 CERT-PL: cert.pl
- 🇵🇱 CERT-PL: cert.pl
Vulnerability details
Web services managed by Edito CMS (Content Management System) in versions from 3.5 through 3.25 leak sensitive data as they allow downloading configuration files by an unauthenticated user. The issue in versions 3.5 - 3.25 was removed in releases which…
more
dates from 10th of January 2014. Higher versions were never affected.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Controls on authorized publication limit files and directories with nonpublic data from becoming accessible to external parties.
Controlling and documenting P2P file sharing prevents files and directories from being made accessible to external parties for unauthorized distribution.
Identifying and documenting file and directory locations allows restriction of access to external parties.
Protecting backup files ensures they are not accessible to external parties or unauthorized spheres.
Sanitizing equipment before off-site maintenance reduces the risk of files or directories containing sensitive data becoming accessible to external parties.
Policy restricts media access to authorized parties only, preventing exposure of resources to external or unauthorized actors.
Media access restrictions prevent files or directories from being accessible to external parties.
Employing and evaluating controls at documented alternate sites makes files and directories less likely to be accessible to external parties through physical or environmental weaknesses.