CVE-2024-49780: IBM OpenPages path traversal
IBM OpenPages could allow a remote attacker to traverse directories on the system. An attacker with privileges to perform Import Configuration could send a specially crafted http request containing "dot dot" sequences (/../) in the file name parameter used in Import Configuration to write files to arbitrary locations outside of the specified directory and possibly overwrite arbitrary files.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-49780?
CVE-2024-49780 is classified as a high severity vulnerability due to its potential for directory traversal by a remote attacker.
How do I fix CVE-2024-49780?
To fix CVE-2024-49780, it is recommended to apply the latest patch provided by IBM for OpenPages versions up to 9.0 and OpenPages with Watson versions up to 8.3.
Who is affected by CVE-2024-49780?
CVE-2024-49780 affects IBM OpenPages versions up to 9.0 and IBM OpenPages with Watson versions up to 8.3.
What is the exploit mechanism for CVE-2024-49780?
CVE-2024-49780 can be exploited through crafted HTTP requests that include "dot dot" sequences to manipulate file paths in Import Configuration.
What type of vulnerability is CVE-2024-49780?
CVE-2024-49780 is a directory traversal vulnerability that can allow unauthorized access to sensitive parts of the filesystem.