CVE-2024-22723: Webtrees Path Traversal vulnerability in fisharebest/webtrees
Summary
CVE-2024-22723: Webtrees Path Traversal vulnerability. Affects fisharebest/webtrees versions < 2.1.18. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Webtrees is an open-source genealogy application that allows users to create and manage their family trees. It provides a web-based interface for users to organize and share their genealogical data. The fisharebest/webtrees package is a specific version of Webtrees that is affected by a Path Traversal vulnerability.
Vulnerability Detail
The Webtrees 2.1.18 version is vulnerable to a Directory Traversal attack. This vulnerability arises from a flaw in the handling of the 'media_folder' parameter in the application's URL. By manipulating this parameter, an attacker, even an administrator, can navigate beyond the intended directory ('media/') and gain unauthorized access to sensitive files in other parts of the application's file system. This can lead to the exposure of confidential information and potential compromise of the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the official patch or upgrade to a non-vulnerable version to mitigate the risk.
Conclusion
The Webtrees 2.1.18 version of the fisharebest/webtrees package is vulnerable to a Path Traversal attack. This vulnerability allows an attacker to access sensitive files outside of the intended directory. It is recommended to upgrade to a non-vulnerable version or apply the official patch to mitigate the risk.
See every vulnerability recorded for fisharebest/webtrees →
FAQ
Webtrees is an open-source genealogy application that allows users to create and manage their family trees. It provides a web-based interface for users to organize and share their genealogical data.
fisharebest/webtrees is a specific version of Webtrees that is affected by the Path Traversal vulnerability.
A Path Traversal vulnerability allows an attacker to access files and directories outside of the intended scope of an application. In this case, by manipulating the 'media_folder' parameter in the URL, an attacker can navigate to sensitive files in the Webtrees application's file system.
This vulnerability can lead to the exposure of confidential information stored in the Webtrees application. It can also potentially allow an attacker to compromise the system by gaining unauthorized access to sensitive files.
To protect your Webtrees installation, it is crucial to upgrade to a non-vulnerable version or apply the official patch provided by the Webtrees developers. Regularly updating the software and following security best practices can help mitigate the risk of such vulnerabilities.
