CVE-2024-40348 is a high-severity directory traversal vulnerability affecting Bazarr versions prior to 1.4.3. Unauthenticated attackers can exploit a flaw in the /api/swaggerui/static component to read arbitrary files from the server, potentially leading to information disclosure. With a CVSS score of 8.2 (High) and an EPSS score indicating a high likelihood of exploitation, this vulnerability is easily exploitable over the network with low attack complexity and no user interaction required. While not yet in the KEV catalog, public Nuclei templates exist for this vulnerability, suggesting a potential for future exploitation, though there is currently no significant community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 1.4.3CPE matchmatch criteria | cpe:2.3:a:bazarr:bazarr:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.