CVE-2024-3078

Qdrant Full Snapshot REST API snapshots.rs path traversal

State: Published
Severity: 5.5 Medium
Published: Mar 29, 2024
Updated: Aug 1, 2024
Reserved: Mar 29, 2024

Description

A vulnerability was found in Qdrant up to 1.6.1/1.7.4/1.8.2 and classified as critical. This issue affects some unknown processing of the file lib/collection/src/collection/snapshots.rs of the component Full Snapshot REST API. The manipulation leads to path traversal. Upgrading to version 1.8.3 is able to address this issue. The patch is named 3ab5172e9c8f14fa1f7b24e7147eac74e2412b62. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-258611.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L	VulDB
3.0	5.5 Medium	CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L	VulDB
2.0	5.2 Medium	AV:A/AC:L/Au:S/C:P/I:P/A:P	VulDB

Weaknesses

CWE-22 Path Traversal

Affected Products

Product	Versions
Qdrantn/a	1.6.0Affected 1.6.1Affected 1.7.0Affected 1.7.1Affected 1.7.2Affected 1.7.3Affected 1.7.4Affected 1.8.0Affected 1.8.1Affected 1.8.2Affected

References

VDB-258611 | Qdrant Full Snapshot REST API snapshots.rs path traversalvdb-entry
VDB-258611 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
https://github.com/qdrant/qdrant/pull/3856issue-tracking
https://github.com/qdrant/qdrant/commit/3ab5172e9c8f14fa1f7b24e7147eac74e2412b62patch
https://github.com/qdrant/qdrant/releases/tag/v1.8.3patch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.