CVE-2024-46212: Path Traversal Vulnerability in REDAXO CMS
Summary
CVE-2024-46212: Path traversal in redaxo. Affects redaxo/source versions < 5.17.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
REDAXO is a flexible and user-friendly content management system (CMS) designed for developers and users alike. It allows for easy management of website content and features a modular architecture that supports various extensions. However, version 5.17.1 of REDAXO CMS has a critical vulnerability that exposes the system to directory traversal attacks, potentially compromising the integrity of the server's file system.
Vulnerability Detail
The vulnerability arises from improper input validation in the component located at /index.php?page=backup/export of REDAXO CMS v5.17.1. This flaw allows attackers to manipulate file paths, enabling them to access sensitive files outside the intended directory. The ramifications of this vulnerability can be severe, as it may lead to unauthorized access to configuration files, user data, or other sensitive information stored on the server. The issue is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), highlighting its nature as a path traversal vulnerability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can restrict access to the backup/export functionality by modifying server permissions or implementing additional input validation checks to sanitize user inputs before processing them.
Conclusion
The path traversal vulnerability in REDAXO CMS v5.17.1 poses a significant risk to users, allowing attackers to exploit the system and access sensitive files. It is crucial for users to update their installations to the latest version to mitigate this risk. Utilizing tools like Vulert can further enhance security by providing real-time monitoring for vulnerabilities.
See every vulnerability recorded for redaxo/source →
FAQ
A path traversal vulnerability allows an attacker to access files and directories that are stored outside the intended directory, potentially leading to unauthorized data exposure.
If you are using REDAXO CMS version 5.17.1, your installation is affected by this vulnerability. You can also use Vulert's playground to check for vulnerabilities without needing to install anything.
The potential impacts include unauthorized access to sensitive files, exposure of user data, and possible server compromise.
Yes, updating to the latest version of REDAXO CMS will patch this vulnerability. Ensure you run 'composer update redaxo/source' to apply the fix.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in your software using just the composer.lock file. You can check if your application is affected by this vulnerability using Vulert's playground.
References
Related vulnerabilities
Recent vulnerabilities recorded for redaxo/source.
