Improper URL validation leads to path traversal in FileCatalyst Direct 3.8.8 and earlier allowing an encoded payload to cause the web server to return files located outside of the web root which may lead to data leakage.
References
| Link | Resource |
|---|---|
| https://filecatalyst.software/public/filecatalyst/Direct/3.8.9.90/whatsnew_direct.html | Release Notes |
| https://filecatalyst.software/public/filecatalyst/Direct/3.8.9.90/whatsnew_direct.html | Release Notes |
| https://www.fortra.com/security/advisory/fi-2024-003 | Vendor Advisory |
| https://www.fortra.com/security/advisory/fi-2024-003 | Vendor Advisory |
Configurations
History
21 Jan 2025, 19:01
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://filecatalyst.software/public/filecatalyst/Direct/3.8.9.90/whatsnew_direct.html - Release Notes | |
| References | () https://www.fortra.com/security/advisory/fi-2024-003 - Vendor Advisory | |
| CWE | CWE-22 | |
| First Time |
Fortra
Fortra filecatalyst Direct |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.3 |
| CPE | cpe:2.3:a:fortra:filecatalyst_direct:*:*:*:*:*:*:*:* |
13 Mar 2024, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-03-13 15:15
Updated : 2025-01-21 19:01
NVD link : CVE-2024-25154
Mitre link : CVE-2024-25154
JSON object : View
Products Affected
fortra
- filecatalyst_direct
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')