CVE-2024-52600

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-52600", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-11-14T15:05:46.770Z", "datePublished": "2024-11-19T16:30:12.221Z", "dateUpdated": "2024-12-03T17:18:17.282Z"}, "containers": {"cna": {"title": "Statamic CMS has Path Traversal in Asset Upload", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/statamic/cms/security/advisories/GHSA-p7f6-8mcm-fwv3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/statamic/cms/security/advisories/GHSA-p7f6-8mcm-fwv3"}, {"name": "https://github.com/statamic/cms/commit/0c07c10009a2439c8ee56c8faefd1319dc6e388d", "tags": ["x_refsource_MISC"], "url": "https://github.com/statamic/cms/commit/0c07c10009a2439c8ee56c8faefd1319dc6e388d"}, {"name": "https://github.com/statamic/cms/commit/400875b20f40e1343699d536a432a6fc284346da", "tags": ["x_refsource_MISC"], "url": "https://github.com/statamic/cms/commit/400875b20f40e1343699d536a432a6fc284346da"}, {"name": "https://github.com/statamic/cms/commit/4cc2c9bd0f39a93b3fc7e9ef0f12792576fd380d", "tags": ["x_refsource_MISC"], "url": "https://github.com/statamic/cms/commit/4cc2c9bd0f39a93b3fc7e9ef0f12792576fd380d"}], "affected": [{"vendor": "statamic", "product": "cms", "versions": [{"version": "< 5.17.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-11-19T16:30:12.221Z"}, "descriptions": [{"lang": "en", "value": "Statmatic is a Laravel and Git powered content management system (CMS). Prior to version 5.17.0, assets uploaded with appropriately crafted filenames may result in them being placed in a location different than what was configured. The issue affects front-end forms with `assets` fields and other places where assets can be uploaded, although users would need upload permissions anyway. Files can be uploaded so they would be located on the server in a different location, and potentially override existing files. Traversal outside an asset container is not possible. This path traversal vulnerability has been fixed in 5.17.0."}], "source": {"advisory": "GHSA-p7f6-8mcm-fwv3", "discovery": "UNKNOWN"}}, "adp": [{"affected": [{"vendor": "statamic", "product": "statamic", "cpes": ["cpe:2.3:a:statamic:statamic:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "5.17.0", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-11-20T16:41:07.240898Z", "id": "CVE-2024-52600", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-03T17:18:17.282Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-52600", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-11-20T16:41:07.240898Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:statamic:statamic:*:*:*:*:*:*:*:*"], "vendor": "statamic", "product": "statamic", "versions": [{"status": "affected", "version": "0", "lessThan": "5.17.0", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-03T17:18:04.997Z"}}], "cna": {"title": "Statamic CMS has Path Traversal in Asset Upload", "source": {"advisory": "GHSA-p7f6-8mcm-fwv3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "statamic", "product": "cms", "versions": [{"status": "affected", "version": "< 5.17.0"}]}], "references": [{"url": "https://github.com/statamic/cms/security/advisories/GHSA-p7f6-8mcm-fwv3", "name": "https://github.com/statamic/cms/security/advisories/GHSA-p7f6-8mcm-fwv3", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/statamic/cms/commit/0c07c10009a2439c8ee56c8faefd1319dc6e388d", "name": "https://github.com/statamic/cms/commit/0c07c10009a2439c8ee56c8faefd1319dc6e388d", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/statamic/cms/commit/400875b20f40e1343699d536a432a6fc284346da", "name": "https://github.com/statamic/cms/commit/400875b20f40e1343699d536a432a6fc284346da", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/statamic/cms/commit/4cc2c9bd0f39a93b3fc7e9ef0f12792576fd380d", "name": "https://github.com/statamic/cms/commit/4cc2c9bd0f39a93b3fc7e9ef0f12792576fd380d", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Statmatic is a Laravel and Git powered content management system (CMS). Prior to version 5.17.0, assets uploaded with appropriately crafted filenames may result in them being placed in a location different than what was configured. The issue affects front-end forms with `assets` fields and other places where assets can be uploaded, although users would need upload permissions anyway. Files can be uploaded so they would be located on the server in a different location, and potentially override existing files. Traversal outside an asset container is not possible. This path traversal vulnerability has been fixed in 5.17.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-11-19T16:30:12.221Z"}}}, "cveMetadata": {"cveId": "CVE-2024-52600", "state": "PUBLISHED", "dateUpdated": "2024-12-03T17:18:17.282Z", "dateReserved": "2024-11-14T15:05:46.770Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-11-19T16:30:12.221Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "cms", "vendor": "statamic", "versions": [{"status": "affected", "version": "< 5.17.0"}]}], "source": "security-advisories@github.com"}, {"affectedData": [{"cpes": ["cpe:2.3:a:statamic:statamic:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "statamic", "vendor": "statamic", "versions": [{"lessThan": "5.17.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Statmatic is a Laravel and Git powered content management system (CMS). Prior to version 5.17.0, assets uploaded with appropriately crafted filenames may result in them being placed in a location different than what was configured. The issue affects front-end forms with `assets` fields and other places where assets can be uploaded, although users would need upload permissions anyway. Files can be uploaded so they would be located on the server in a different location, and potentially override existing files. Traversal outside an asset container is not possible. This path traversal vulnerability has been fixed in 5.17.0."}, {"lang": "es", "value": "Statmatic es un sistema de gesti\u00f3n de contenido (CMS) basado en Laravel y Git. Antes de la versi\u00f3n 5.17.0, los recursos cargados con nombres de archivo manipulados de forma adecuada pod\u00edan hacer que se colocaran en una ubicaci\u00f3n diferente a la configurada. El problema afecta a los formularios de interfaz con campos de \"recursos\" y otros lugares donde se pueden cargar recursos, aunque los usuarios necesitar\u00edan permisos de carga de todos modos. Los archivos se pueden cargar para que se ubiquen en el servidor en una ubicaci\u00f3n diferente y potencialmente anulen los archivos existentes. No es posible atravesar un contenedor de recursos fuera de \u00e9l. Esta vulnerabilidad de path traversal se ha corregido en la versi\u00f3n 5.17.0."}], "id": "CVE-2024-52600", "lastModified": "2026-06-17T08:07:31.683", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-52600", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-11-20T16:41:07.240898Z", "version": "2.0.3"}}]}, "published": "2024-11-19T17:15:56.030", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/statamic/cms/commit/0c07c10009a2439c8ee56c8faefd1319dc6e388d"}, {"source": "security-advisories@github.com", "url": "https://github.com/statamic/cms/commit/400875b20f40e1343699d536a432a6fc284346da"}, {"source": "security-advisories@github.com", "url": "https://github.com/statamic/cms/commit/4cc2c9bd0f39a93b3fc7e9ef0f12792576fd380d"}, {"source": "security-advisories@github.com", "url": "https://github.com/statamic/cms/security/advisories/GHSA-p7f6-8mcm-fwv3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{}