« Volver al listado

CVE-2024-32982

Estado: AplazadaAlta (8.2)—

Litestar and Starlite is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.8.3, 2.7.2, and 2.6.4, a Local File Inclusion (LFI) vulnerability has been discovered in the static file serving component of LiteStar. This vulnerability allows attackers to exploit path traversal flaws, enabling unauthorized access to sensitive files outside the designated directories. Such access can lead to the disclosure of sensitive information or potentially compromise the server. The vulnerability is located in the file path handling mechanism within the static content serving function, specifically at `litestar/static_files/base.py`. This vulnerability is fixed in versions 2.8.3, 2.7.2, and 2.6.4.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Litestar — LitestarAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-32982",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-32982",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-07-03T14:26:20.026909Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "litestar-org",
          "product": "litestar",
          "versions": [
            {
              "status": "affected",
              "version": ">= 2.8.0, < 2.8.3"
            },
            {
              "status": "affected",
              "version": ">= 1.37.0, <= 1.51.14"
            },
            {
              "status": "affected",
              "version": ">= 2.7.0, < 2.7.2"
            },
            {
              "status": "affected",
              "version": ">= 2.0.0, < 2.6.4"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:starliteproject:starlite:1.37.0:*:*:*:*:*:*:*"
          ],
          "vendor": "starliteproject",
          "product": "starlite",
          "versions": [
            {
              "status": "affected",
              "version": "1.37.0",
              "versionType": "custom",
              "lessThanOrEqual": "1.51.14"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:starliteproject:starlite:2.0.0:*:*:*:*:*:*:*"
          ],
          "vendor": "starliteproject",
          "product": "starlite",
          "versions": [
            {
              "status": "affected",
              "version": "2.0.0",
              "lessThan": "2.6.4",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:starliteproject:starlite:2.7.0:*:*:*:*:*:*:*"
          ],
          "vendor": "starliteproject",
          "product": "starlite",
          "versions": [
            {
              "status": "affected",
              "version": "2.7.0",
              "lessThan": "2.7.2",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:starliteproject:starlite:2.8.0:*:*:*:*:*:*:*"
          ],
          "vendor": "starliteproject",
          "product": "starlite",
          "versions": [
            {
              "status": "affected",
              "version": "2.8.0",
              "lessThan": "2.8.3",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-05-06T15:15:23.330",
  "references": [
    {
      "url": "https://github.com/litestar-org/litestar/blob/main/litestar/static_files/base.py#L70",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/litestar-org/litestar/commit/57e706e7effdc182fc9a2af5981bc88afb21851b",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/litestar-org/litestar/security/advisories/GHSA-83pv-qr33-2vcf",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/litestar-org/litestar/blob/main/litestar/static_files/base.py#L70",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/litestar-org/litestar/commit/57e706e7effdc182fc9a2af5981bc88afb21851b",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/litestar-org/litestar/security/advisories/GHSA-83pv-qr33-2vcf",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Litestar and Starlite is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.8.3, 2.7.2, and 2.6.4, a Local File Inclusion (LFI) vulnerability has been discovered in the static file serving component of LiteStar. This vulnerability allows attackers to exploit path traversal flaws, enabling unauthorized access to sensitive files outside the designated directories. Such access can lead to the disclosure of sensitive information or potentially compromise the server. The vulnerability is located in the file path handling mechanism within the static content serving function, specifically at `litestar/static_files/base.py`. This vulnerability is fixed in versions 2.8.3, 2.7.2, and 2.6.4."
    },
    {
      "lang": "es",
      "value": "Litestar y Starlite es un framework de interfaz de puerta de enlace de servidor asíncrono (ASGI). Antes de las versiones 2.8.3, 2.7.2 y 2.6.4, se descubrió una vulnerabilidad de inclusión de archivos locales (LFI) en el componente de servicio de archivos estáticos de LiteStar. Esta vulnerabilidad permite a los atacantes explotar fallas de path traversal, permitiendo el acceso no autorizado a archivos confidenciales fuera de los directorios designados. Dicho acceso puede dar lugar a la divulgación de información confidencial o potencialmente comprometer el servidor. La vulnerabilidad se encuentra en el mecanismo de manejo de rutas de archivos dentro de la función de servicio de contenido estático, específicamente en `litestar/static_files/base.py`. Esta vulnerabilidad se solucionó en las versiones 2.8.3, 2.7.2 y 2.6.4."
    }
  ],
  "lastModified": "2026-06-17T07:30:49.043",
  "sourceIdentifier": "security-advisories@github.com"
}