« Volver al listado

CVE-2024-2055

Estado: AnalizadaCrítica (9.8)—

The "Rich Filemanager" feature of Artica Proxy provides a web-based interface for file management capabilities. When the feature is enabled, it does not require authentication by default, and runs as the root user.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Articatech — Artica Proxy

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-2055",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-2055",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-08-26T15:57:01.965216Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@takeonme.org",
      "affectedData": [
        {
          "vendor": "Artica Tech",
          "product": "Artica Proxy",
          "versions": [
            {
              "status": "affected",
              "version": "4.50"
            },
            {
              "status": "affected",
              "version": "4.40"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:articatech:artica_proxy:*:*:*:*:*:*:*:*"
          ],
          "vendor": "articatech",
          "product": "artica_proxy",
          "versions": [
            {
              "status": "affected",
              "version": "4.50"
            },
            {
              "status": "affected",
              "version": "4.40"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-03-05T20:16:01.617",
  "references": [
    {
      "url": "http://seclists.org/fulldisclosure/2024/Mar/13",
      "tags": [
        "Exploit",
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "cve@takeonme.org"
    },
    {
      "url": "https://korelogic.com/Resources/Advisories/KL-001-2024-003.txt",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "cve@takeonme.org"
    },
    {
      "url": "http://seclists.org/fulldisclosure/2024/Mar/13",
      "tags": [
        "Exploit",
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://korelogic.com/Resources/Advisories/KL-001-2024-003.txt",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve@takeonme.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-288"
        },
        {
          "lang": "en",
          "value": "CWE-552"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The \"Rich Filemanager\" feature of Artica Proxy provides a web-based interface for file management capabilities. When the feature is enabled, it does not require authentication by default, and runs as the root user."
    },
    {
      "lang": "es",
      "value": "La función \"Rich Filemanager\" de Artica Proxy proporciona una interfaz basada en web para capacidades de administración de archivos. Cuando la función está habilitada, no requiere autenticación de forma predeterminada y se ejecuta como usuario raíz."
    }
  ],
  "lastModified": "2026-06-17T07:23:38.343",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:articatech:artica_proxy:4.40.000000:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "788E6DED-A8AF-499D-BB32-C21786BFD515"
            },
            {
              "criteria": "cpe:2.3:a:articatech:artica_proxy:4.50.000000:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "816CA9A3-CBB5-4689-8A3E-969720226BE1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@takeonme.org"
}