« Volver al listado

CVE-2024-47818

Estado: AplazadaMedia (6.5)—

Saltcorn is an extensible, open source, no-code database application builder. A logged-in user with any role can delete arbitrary files on the filesystem by calling the `sync/clean_sync_dir` endpoint. The `dir_name` POST parameter is not validated/sanitized and is used to construct the `syncDir` that is deleted by calling `fs.rm`. This issue has been addressed in release version 1.0.0-beta16 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Saltcorn — SaltcornAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-47818",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-47818",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-10-08T14:13:36.451606Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "saltcorn",
          "product": "saltcorn",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.0.0-beta.16"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:saltcorn_collective_ltd:saltcorn:*:*:*:*:*:*:*:*"
          ],
          "vendor": "saltcorn_collective_ltd",
          "product": "saltcorn",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.0.0-beta.16",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-10-07T22:15:04.037",
  "references": [
    {
      "url": "https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.15/packages/server/routes/sync.js#L337-L346",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/saltcorn/saltcorn/commit/3c551261d0e230635774798009951fa83a07cc3a",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/saltcorn/saltcorn/security/advisories/GHSA-43f3-h63w-p6f6",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Saltcorn is an extensible, open source, no-code database application builder. A logged-in user with any role can delete arbitrary files on the filesystem by calling the `sync/clean_sync_dir` endpoint. The `dir_name` POST parameter is not validated/sanitized and is used to construct the `syncDir` that is deleted by calling `fs.rm`. This issue has been addressed in release version 1.0.0-beta16 and all users are advised to upgrade. There are no known workarounds for this vulnerability."
    },
    {
      "lang": "es",
      "value": "Saltcorn es un generador de aplicaciones de base de datos extensible, de código abierto y sin código. Un usuario conectado con cualquier función puede eliminar archivos arbitrarios en el sistema de archivos llamando al punto de conexión `sync/clean_sync_dir`. El parámetro POST `dir_name` no se valida ni se desinfecta y se utiliza para construir el `syncDir` que se elimina llamando a `fs.rm`. Este problema se ha solucionado en la versión de lanzamiento 1.0.0-beta16 y se recomienda a todos los usuarios que actualicen. No existen workarounds conocidas para esta vulnerabilidad."
    }
  ],
  "lastModified": "2026-06-17T07:57:48.577",
  "sourceIdentifier": "security-advisories@github.com"
}