En resumen
- CVE-2024-39943 es una vulnerabilidad ALTO (CVSS 8.8) que afecta a http file server (rejetto), hfs.
- Probabilidad de explotación en los próximos 30 días (EPSS): 39.5%, mayor que el 98.6% de las vulnerabilidades.
- Solución: actualizar a 0.52.10 o posterior.
Description
rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload permissions). This occurs because a shell is used to execute df (i.e., with execSync instead of spawnSync in child_process in Node.js).
NVD description
rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload permissions). This occurs because a shell is used to execute df (i.e., with execSync instead of spawnSync in child_process in Node.js).
Más vulnerabilidades de http file server
Ver todo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free