CVE-2024-2564 is a critical path traversal vulnerability affecting PandaXGO PandaX versions up to 20240310, specifically within the ExportUser function in the /apps/system/api/user.go file. This vulnerability allows an unauthenticated, remote attacker to manipulate the 'filename' argument to access arbitrary files and directories outside of the intended scope. With a CVSS score of 7.3 (HIGH), the vulnerability has low attack complexity and can lead to limited confidentiality, integrity, and availability impacts. While the exploit has been publicly disclosed, there is no evidence of active exploitation, and it currently lacks Metasploit, Nuclei, or ExploitDB modules, as well as significant community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 2024-03-10CPE matchmatch criteria | cpe:2.3:a:pandax:pandax:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.