Description

A vulnerability, which was classified as critical, has been found in eNMS up to 4.2. Affected by this issue is the function multiselect_filtering of the file eNMS/controller.py of the component TGZ File Handler. The manipulation leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The patch is identified as 22b0b443acca740fc83b5544165c1f53eff3f529. It is recommended to apply a patch to fix this issue. Eine kritische Schwachstelle wurde in eNMS bis 4.2 entdeckt. Es geht hierbei um die Funktion multiselect_filtering der Datei eNMS/controller.py der Komponente TGZ File Handler. Durch Manipulieren mit unbekannten Daten kann eine path traversal-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk angegangen werden. Der Exploit steht zur öffentlichen Verfügung. Der Patch wird als 22b0b443acca740fc83b5544165c1f53eff3f529 bezeichnet. Als bestmögliche Massnahme wird Patching empfohlen.

Classification

CVE ID: CVE-2024-11664

CVSS Base Severity: HIGH

CVSS Base Score: 8.7

Affected Products

Vendor: n/a

Product: eNMS

Exploit Prediction Scoring System (EPSS)

EPSS Score: 0.32% (probability of being exploited)

EPSS Percentile: 70.19% (scored less or equal to compared to others)

EPSS Date: 2025-02-03 (when was this score calculated)

References

https://vuldb.com/?id.285986
https://vuldb.com/?ctiid.285986
https://vuldb.com/?submit.447374
https://github.com/eNMS-automation/eNMS/pull/419
https://github.com/eNMS-automation/eNMS/pull/419#issuecomment-2495640750
https://mega.nz/folder/ZhIiDQaI#TUJCRV-XN41L-WEVAu0sWg
https://github.com/eNMS-automation/eNMS/pull/419/commits/22b0b443acca740fc83b5544165c1f53eff3f529
https://www.youtube.com/watch?v=FJVFtNb4_qA

Timeline