CVE-2024-38449

Published: Jun 17, 2024Modified: Jun 17, 2026Deferred

7.7

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Exploitability: 3.1 / Impact: 4.0

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

A Directory Traversal vulnerability in KasmVNC 1.3.1.230e50f7b89663316c70de7b0e3db6f6b9340489 and possibly earlier versions allows remote authenticated attackers to browse parent directories and read the content of files outside the scope of the application.

Related CWEs

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (6)

https://github.com/kasmtech/KasmVNC/issues/254

Source: cve@mitre.org

https://kasmweb.atlassian.net/servicedesk/customer/portal/3/topic/30ffee7f-4b85-4783-b118-6ae4fd8b0c52

Source: cve@mitre.org

https://kasmweb.com/kasmvnc

Source: cve@mitre.org

https://github.com/kasmtech/KasmVNC/issues/254

Source: af854a3a-2127-422b-91ae-364da2661108

https://kasmweb.atlassian.net/servicedesk/customer/portal/3/topic/30ffee7f-4b85-4783-b118-6ae4fd8b0c52

Source: af854a3a-2127-422b-91ae-364da2661108

https://kasmweb.com/kasmvnc

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.