CVE-2024-57176
Published: 21 February 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2024-57176 is a directory traversal vulnerability in the shiroFilter function of the White-Jotter project version 0.2.2. The issue enables attackers to access sensitive endpoints via a crafted URL. It carries a CVSS v3.1 base score of 7.6 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) and is classified under CWE-437.
The vulnerability can be exploited remotely by an attacker with low privileges over the network with low attack complexity and no user interaction required. Successful exploitation allows directory traversal to reach sensitive endpoints, resulting in high confidentiality impact through unauthorized data access, along with low-level integrity modification and availability disruption.
The referenced advisory at https://github.com/DYX217/Incorrect-Access-Control provides further details on this incorrect access control issue.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The vulnerability enables directory traversal to bypass Shiro authentication filters and access sensitive admin endpoints (e.g., /api/admin/content/article) in the public-facing White-Jotter web application, facilitating exploitation of public-facing applications.