CVE-2024-46898

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-46898", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "state": "PUBLISHED", "assignerShortName": "jpcert", "dateReserved": "2024-10-04T06:36:35.246Z", "datePublished": "2024-10-15T06:10:30.968Z", "dateUpdated": "2024-10-23T04:58:28.816Z"}, "containers": {"cna": {"affected": [{"vendor": "SHIRASAGI Project", "product": "SHIRASAGI", "versions": [{"version": "prior to v1.19.1", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "SHIRASAGI prior to v1.19.1 processes URLs in HTTP requests improperly, resulting in a path traversal vulnerability. If this vulnerability is exploited, arbitrary files on the server may be retrieved when processing crafted HTTP requests."}], "problemTypes": [{"descriptions": [{"description": "Improper limitation of a pathname to a restricted directory ('Path Traversal')", "lang": "en-US", "cweId": "CWE-22", "type": "CWE"}]}], "references": [{"url": "https://github.com/shirasagi/shirasagi/commit/5ac4685d7e4330f949f13219069107fc5d768934"}, {"url": "https://www.ss-proj.org/"}, {"url": "https://jvn.jp/en/jp/JVN58721679/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_0": {"version": "3.0", "baseSeverity": "HIGH", "baseScore": 8.6, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"}}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2024-10-23T04:58:28.816Z"}}, "adp": [{"affected": [{"vendor": "ss-proj", "product": "shirasagi", "cpes": ["cpe:2.3:a:ss-proj:shirasagi:*:*:*:*:*:*:*:*"], "defaultStatus": "affected", "versions": [{"version": "0", "status": "affected", "lessThan": "1.19.1", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-15T13:46:04.867617Z", "id": "CVE-2024-46898", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-15T13:48:49.696Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-46898", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-15T13:46:04.867617Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:ss-proj:shirasagi:*:*:*:*:*:*:*:*"], "vendor": "ss-proj", "product": "shirasagi", "versions": [{"status": "affected", "version": "0", "lessThan": "1.19.1", "versionType": "custom"}], "defaultStatus": "affected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-15T13:48:29.057Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "baseScore": 8.6, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "SHIRASAGI Project", "product": "SHIRASAGI", "versions": [{"status": "affected", "version": "prior to v1.19.1"}]}], "references": [{"url": "https://github.com/shirasagi/shirasagi/commit/5ac4685d7e4330f949f13219069107fc5d768934"}, {"url": "https://www.ss-proj.org/"}, {"url": "https://jvn.jp/en/jp/JVN58721679/"}], "descriptions": [{"lang": "en", "value": "SHIRASAGI prior to v1.19.1 processes URLs in HTTP requests improperly, resulting in a path traversal vulnerability. If this vulnerability is exploited, arbitrary files on the server may be retrieved when processing crafted HTTP requests."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-22", "description": "Improper limitation of a pathname to a restricted directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2024-10-23T04:58:28.816Z"}}}, "cveMetadata": {"cveId": "CVE-2024-46898", "state": "PUBLISHED", "dateUpdated": "2024-10-23T04:58:28.816Z", "dateReserved": "2024-10-04T06:36:35.246Z", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "datePublished": "2024-10-15T06:10:30.968Z", "assignerShortName": "jpcert"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "SHIRASAGI", "vendor": "SHIRASAGI Project", "versions": [{"status": "affected", "version": "prior to v1.19.1"}]}], "source": "vultures@jpcert.or.jp"}, {"affectedData": [{"cpes": ["cpe:2.3:a:ss-proj:shirasagi:*:*:*:*:*:*:*:*"], "defaultStatus": "affected", "product": "shirasagi", "vendor": "ss-proj", "versions": [{"lessThan": "1.19.1", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ss-proj:shirasagi:*:*:*:*:*:*:*:*", "matchCriteriaId": "66E31BF1-0924-4BED-8A2E-19B101B7DC87", "versionEndExcluding": "1.19.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SHIRASAGI prior to v1.19.1 processes URLs in HTTP requests improperly, resulting in a path traversal vulnerability. If this vulnerability is exploited, arbitrary files on the server may be retrieved when processing crafted HTTP requests."}, {"lang": "es", "value": "Las versiones anteriores a la v1.19.1 de SHIRASAGI procesan las URL de las solicitudes HTTP de forma incorrecta, lo que genera una vulnerabilidad de path traversal. Si se explota esta vulnerabilidad, se pueden recuperar archivos arbitrarios del servidor al procesar solicitudes HTTP manipuladas."}], "id": "CVE-2024-46898", "lastModified": "2026-06-17T07:56:10.080", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 4.0, "source": "vultures@jpcert.or.jp", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-46898", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-10-15T13:46:04.867617Z", "version": "2.0.3"}}]}, "published": "2024-10-15T07:15:02.267", "references": [{"source": "vultures@jpcert.or.jp", "tags": ["Patch"], "url": "https://github.com/shirasagi/shirasagi/commit/5ac4685d7e4330f949f13219069107fc5d768934"}, {"source": "vultures@jpcert.or.jp", "tags": ["Third Party Advisory"], "url": "https://jvn.jp/en/jp/JVN58721679/"}, {"source": "vultures@jpcert.or.jp", "tags": ["Product"], "url": "https://www.ss-proj.org/"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "vultures@jpcert.or.jp", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-22"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}