Em resumo
- CVE-2024-39943 é uma vulnerabilidade ALTO (CVSS 8.8) que afeta http file server (rejetto), hfs.
- Chance de exploração nos próximos 30 dias (EPSS): 39.5%, maior que 98.6% das vulnerabilidades.
- Correção: atualize para 0.52.10 ou posterior.
Description
rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload permissions). This occurs because a shell is used to execute df (i.e., with execSync instead of spawnSync in child_process in Node.js).
NVD description
rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload permissions). This occurs because a shell is used to execute df (i.e., with execSync instead of spawnSync in child_process in Node.js).
Mais vulnerabilidades de http file server
Ver tudo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free