CVE-2024-11312
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to upload arbitrary files to any directory, leading to arbitrary code execution by uploading webshells.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| TRCore | DVC | 6.0 <= 6.3 | affected |
Weaknesses
- CWE-23: CWE-23 Relative Path Traversal
- CWE-434: CWE-434 Unrestricted Upload of File with Dangerous Type
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: yes
- Technical Impact: total
References
- https://www.twcert.org.tw/tw/cp-132-8248-8dac9-1.html
- https://www.twcert.org.tw/en/cp-139-8249-65252-2.html
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.