CVE-2024-24756
High
Description
Crafatar serves Minecraft avatars based on the skin for use in external applications. Files outside of the `lib/public/` directory can be requested from the server. Instances running behind Cloudflare (including crafatar.com) are not affected. Instances using the Docker container as shown in the README are affected, but only files within the container can be read. By default, all of the files within the container can also be found in this repository and are not confidential. This vulnerability is patched in 2.1.5.
SeverityHigh
CVSS7.5
Exploit probability—
ProductCrafatar
PublishedFeb 1, 2024
First seenFeb 1, 2024
Weakness typeCWE-22Path traversal
How to fix
Update
- crafatar crafatar2.1.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| crafatar crafatar | v < 2.1.5 | 2.1.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.