CVE-2024-2825 is a critical path traversal vulnerability affecting lakernote EasyAdmin up to version 20240315, specifically within the /ureport/designer/saveReportFile component. An attacker can remotely manipulate the 'file' argument to traverse directories, potentially leading to unauthorized file access, modification, or deletion. With a CVSS score of 8.8 (High), this vulnerability is easily exploitable over the network with low privileges and no user interaction, posing a significant risk to confidentiality, integrity, and availability. While public exploit details exist and there is some community discussion and media coverage, it is not currently listed in CISA's KEV catalog, and no Metasploit or Nuclei exploits are publicly available.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 2024-03-15CPE matchmatch criteria | cpe:2.3:a:lakernote:easyadmin:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.