CVE-2024-38292

CVE-2024-38292 is a path traversal vulnerability (CWE-22) affecting Extreme Networks XIQ-SE versions before 24.2.11. The issue stems from a missing access control check, which enables attackers to traverse directories and potentially escalate privileges. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its high impact on confidentiality, integrity, and availability.

An unauthenticated remote attacker with network access can exploit this vulnerability with low attack complexity and no user interaction. Exploitation allows traversal of intended file paths, leading to privilege escalation and potential unauthorized access to sensitive data or system controls.

Extreme Networks security advisory SA-2024-104 addresses this issue, recommending an upgrade to XIQ-SE version 24.2.11 or later as the primary mitigation. Additional details are available at https://community.extremenetworks.com/t5/security-advisories-formerly/sa-2024-104-xiq-se-path-traversal-privilege-escalation-cve-2024/ba-p/116362.