« Volver al listado

CVE-2024-48914

Estado: AplazadaCrítica (9.1)—

Vendure is an open-source headless commerce platform. Prior to versions 3.0.5 and 2.3.3, a vulnerability in Vendure's asset server plugin allows an attacker to craft a request which is able to traverse the server file system and retrieve the contents of arbitrary files, including sensitive data such as configuration files, environment variables, and other critical data stored on the server. In the same code path is an additional vector for crashing the server via a malformed URI. Patches are available in versions 3.0.5 and 2.3.3. Some workarounds are also available. One may use object storage rather than the local file system, e.g. MinIO or S3, or define middleware which detects and blocks requests with urls containing `/../`.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad de traversal (CWE-22) en plugin de servidor de activos accesible por red sin autenticación (AV:N/PR:N). Permite lectura de archivos arbitrarios (C:H) y DoS mediante URI malformado (A:H).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficVulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkApplication Isolation and Sandboxing

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Vendure — VendureAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-48914",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-48914",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-10-15T18:54:53.009476Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.1,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "vendure-ecommerce",
          "product": "vendure",
          "versions": [
            {
              "status": "affected",
              "version": "< 2.3.3"
            },
            {
              "status": "affected",
              "version": ">= 3.0.0, < 3.0.5"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:vendure:vendure:*:*:*:*:*:*:*:*"
          ],
          "vendor": "vendure",
          "product": "vendure",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "2.3.3",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "3.0.0"
            },
            {
              "status": "affected",
              "version": "0",
              "lessThan": "3.0.5",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-10-15T16:15:06.270",
  "references": [
    {
      "url": "https://github.com/vendure-ecommerce/vendure/blob/801980e8f599c28c5059657a9d85dd03e3827992/packages/asset-server-plugin/src/plugin.ts#L352-L358",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/vendure-ecommerce/vendure/commit/e2ee0c43159b3d13b51b78654481094fdd4850c5",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/vendure-ecommerce/vendure/commit/e4b58af6822d38a9c92a1d8573e19288b8edaa1c",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/vendure-ecommerce/vendure/security/advisories/GHSA-r9mq-3c9r-fmjq",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        },
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vendure is an open-source headless commerce platform. Prior to versions 3.0.5 and 2.3.3, a vulnerability in Vendure's asset server plugin allows an attacker to craft a request which is able to traverse the server file system and retrieve the contents of arbitrary files, including sensitive data such as configuration files, environment variables, and other critical data stored on the server. In the same code path is an additional vector for crashing the server via a malformed URI. Patches are available in versions 3.0.5 and 2.3.3. Some workarounds are also available. One may use object storage rather than the local file system, e.g. MinIO or S3, or define middleware which detects and blocks requests with urls containing `/../`."
    },
    {
      "lang": "es",
      "value": "Vendure es una plataforma de comercio sin interfaz gráfica de código abierto. Antes de las versiones 3.0.5 y 2.3.3, una vulnerabilidad en el complemento de servidor de activos de Vendure permitía a un atacante crear una solicitud que pudiera atravesar el sistema de archivos del servidor y recuperar el contenido de archivos arbitrarios, incluidos datos confidenciales como archivos de configuración, variables de entorno y otros datos críticos almacenados en el servidor. En la misma ruta de código hay un vector adicional para hacer que el servidor se bloquee mediante una URL mal formada. Hay parches disponibles en las versiones 3.0.5 y 2.3.3. También hay algunos workarounds disponibles. Se puede utilizar el almacenamiento de objetos en lugar del sistema de archivos local, por ejemplo, MinIO o S3, o definir un middleware que detecte y bloquee las solicitudes con URL que contengan `/../`."
    }
  ],
  "lastModified": "2026-06-17T07:59:01.720",
  "sourceIdentifier": "security-advisories@github.com"
}