Riskcovery

CVE-2024-7340

W&B Weave server remote arbitrary file leak and privilege escalation

State
Published
Severity
8.8 High
Published
Jul 31, 2024
Updated
Nov 25, 2024
Reserved
Jul 31, 2024

Read the record on cve.org

Description

The Weave server API allows remote users to fetch files from a specific directory, but due to a lack of input validation, it is possible to traverse and leak arbitrary files remotely. In various common scenarios, this allows a low-privileged user to assume the role of the server admin.

Scores

CVSSScoreVectorSource
3.18.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HJFROG

Weaknesses

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
  • CWE-20 Improper Input Validation

Affected Products

ProductVersions
weave
  • 0.50.7 and earlierAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.