CVE-2024-46987

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-46987
Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. A path traversal vulnerability accessible via MediaController's download_private_file method allows authenticated users to download any file on the web server Camaleon CMS is running on (depending on the file permissions). This issue may lead to Information Disclosure. This issue has been addressed in release version 2.8.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.

7.7 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 3.1 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://codeql.github.com/codeql-query-help/ruby/rb-path-injection Third Party Advisory
https://github.com/owen2345/camaleon-cms/security/advisories/GHSA-cp65-5m9r-vc2c Exploit Third Party Advisory
https://owasp.org/www-community/attacks/Path_Traversal Issue Tracking
https://securitylab.github.com/advisories/GHSL-2024-182_GHSL-2024-186_Camaleon_CMS
https://www.reddit.com/r/rails/comments/1exwtdm/camaleon_cms_281_has_been_released Patch
Configurations

Configuration 1 (hide)

cpe:2.3:a:tuzitio:camaleon_cms:*:*:*:*:*:*:*:*
History

17 Apr 2025, 19:15

Type Values Removed Values Added
References
  • () https://securitylab.github.com/advisories/GHSL-2024-182_GHSL-2024-186_Camaleon_CMS -

24 Sep 2024, 16:27

Type Values Removed Values Added
CPE cpe:2.3:a:tuzitio:camaleon_cms:*:*:*:*:*:*:*:*
CWE CWE-200
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.7
First Time Tuzitio camaleon Cms
Tuzitio
References () https://www.reddit.com/r/rails/comments/1exwtdm/camaleon_cms_281_has_been_released - () https://www.reddit.com/r/rails/comments/1exwtdm/camaleon_cms_281_has_been_released - Patch
References () https://github.com/owen2345/camaleon-cms/security/advisories/GHSA-cp65-5m9r-vc2c - () https://github.com/owen2345/camaleon-cms/security/advisories/GHSA-cp65-5m9r-vc2c - Exploit, Third Party Advisory
References () https://codeql.github.com/codeql-query-help/ruby/rb-path-injection - () https://codeql.github.com/codeql-query-help/ruby/rb-path-injection - Third Party Advisory
References () https://owasp.org/www-community/attacks/Path_Traversal - () https://owasp.org/www-community/attacks/Path_Traversal - Issue Tracking

18 Sep 2024, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-09-18 18:15

Updated : 2025-04-17 19:15

NVD link : CVE-2024-46987

Mitre link : CVE-2024-46987

JSON object : View

Products Affected

tuzitio

  • camaleon_cms
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')