CVE-2024-9362

Deeper analysis

An unauthenticated directory traversal vulnerability exists in Polyaxon, affecting the latest version. Tracked as CVE-2024-9362 and assigned CWE-22, the flaw permits retrieval of directory listings and file contents from the server without authorization, exposing sensitive data including system paths such as /etc. It carries a CVSS 3.0 base score of 7.5 reflecting network attack vector, low complexity, and no required credentials or user interaction.

An attacker with network access can exploit the issue to read arbitrary files and directory structures on the affected Polyaxon instance, resulting in disclosure of confidential information and elevated security risk. The EPSS score stands at 0.2456 with an identical peak value, indicating no material increase in exploitation probability since disclosure. The sole reference points to a Huntr bounty entry without accompanying mitigation or patch guidance.