ZIPLINE · CVE-2024-58404 · Other
NO FIX YET · SEE WHAT TO DO
Zipline, a self-hosted file sharing server, has a path traversal flaw in its user data export endpoint, controlled by the name query parameter. An logged-in attacker can use directory traversal sequences to read arbitrary files from the server host.
first public Sep 12, 2024 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that self-host Zipline from version 3.4.5 up to but not including 3.7.10 are exposed. The attacker needs a valid user account on the instance, so instances with open registration or shared logins carry more risk than those restricted to trusted users.
Not affected if no-user-accounts, version-3.7.10-or-later
Who cares self-hosted, zipline
3.4.5 before 3.7.10.3.7.10 or later.Zipline versions from 3.4.5 before 3.7.10 contain a path traversal vulnerability in the user data export endpoint via the name query parameter. Authenticated attackers can bypass the user id check and use directory traversal sequences to read arbitrary files on the server host.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.