CVE-2024-25975

Medium

Description

The application implements an up- and downvote function which alters a value within a JSON file. The POST parameters are not filtered properly and therefore an arbitrary file can be overwritten. The file can be controlled by an authenticated attacker, the content cannot be controlled. It is possible to overwrite all files for which the webserver has write access. It is required to supply a relative path (path traversal).

SeverityMedium

CVSS6.5

Exploit probability—

ProductHAWKI

PublishedMay 29, 2024

First seenMay 29, 2024

Weakness typeCWE-73CWE-73

How to fix

Patches

github.com/HAWK-Digital-Environments/HAWKI/commit/146967f3148e92d1640ffebc21d8914e2d7fb3f1

Affected products

Product	Affected versions	Fixed in
Interaction Design Team at the University of Applied Sciences and Arts in Hildesheim/Germany HAWKI	versions before commit 146967f	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.