- Description
- SiYuan is a personal knowledge management system. Prior to version 3.1.16, SiYuan's /api/export/exportResources endpoint is vulnerable to arbitary file read via path traversal. It is possible to manipulate the paths parameter to access and download arbitrary files from the host system by traversing the workspace directory structure. Version 3.1.16 contains a patch for the issue.
- Source
- security-advisories@github.com
- NVD status
- Received
CVSS 4.0
- Type
- Secondary
- Base score
- 8.7
- Impact score
- -
- Exploitability score
- -
- Vector string
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Severity
- HIGH
- security-advisories@github.com
- CWE-22
- Hype score
- Not currently trending
CVE-2024-55658 Path Traversal Vulnerability in SiYuan Pre-3.1.16 Allows ... https://t.co/nqSldWit2K Don't wait vulnerability scanning results: https://t.co/oh1APvMMnd
@VulmonFeeds
12 Dec 2024
4 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[CVE-2024-55658: HIGH] Beware: Prior to SiYuan v3.1.16, /api/export/exportResources was vulnerable to file read via path traversal. Update to secure your system from potential exploits.#cybersecurity,#vulnerability https://t.co/ZhlVnk6ZMd https://t.co/Mdvf3ur6VL
@CveFindCom
11 Dec 2024
58 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes