En bref
- CVE-2024-55658 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant github.com/siyuan-note/siyuan/kernel, siyuan (b3log).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.60%, plus élevée que 49.0% des vulnérabilités.
- Aucune version corrigée n'est encore connue : suivez l'avis de l'éditeur dans les références.
Description
Summary
Siyuan's /api/export/exportResources endpoint is vulnerable to arbitary file read via path traversal. It is possible to manipulate the paths parameter to access and download arbitrary files from the host system by traversing the workspace directory structure.
Impact
Arbitrary File Read
NVD description
SiYuan is a personal knowledge management system. Prior to version 3.1.16, SiYuan's /api/export/exportResources endpoint is vulnerable to arbitary file read via path traversal. It is possible to manipulate the paths parameter to access and download arbitrary files from the host system by traversing the workspace directory structure. Version 3.1.16 contains a patch for the issue.
Autres vulnérabilités de github.com/siyuan-note/siyuan/kernel
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free