CVE-2024-10100

{"id": "CVE-2024-10100", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "security@huntr.dev", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2024-10-17T19:15:21.533", "references": [{"url": "https://huntr.com/bounties/e58a0fb4-2b1d-49ef-b32e-bb62659a6f99", "source": "security@huntr.dev"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security@huntr.dev", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "A path traversal vulnerability exists in binary-husky/gpt_academic version 3.83. The vulnerability is due to improper handling of the file parameter, which is open to path traversal through URL encoding. This allows attackers to view any file on the host system, including sensitive files such as critical application files, SSH keys, API keys, and configuration values."}, {"lang": "es", "value": "Existe una vulnerabilidad de path traversal en la versi\u00f3n 3.83 de binary-husky/gpt_academic. La vulnerabilidad se debe a un manejo inadecuado del par\u00e1metro de archivo, que est\u00e1 abierto al path traversal a trav\u00e9s de la codificaci\u00f3n de URL. Esto permite a los atacantes ver cualquier archivo en el sistema host, incluidos archivos confidenciales como archivos de aplicaciones cr\u00edticas, claves SSH, claves API y valores de configuraci\u00f3n."}], "lastModified": "2024-11-04T19:15:05.297", "sourceIdentifier": "security@huntr.dev"}