« Volver al listado

CVE-2024-3318

Estado: AplazadaMedia (4.2)—

A file path traversal vulnerability was identified in the DelimitedFileConnector Cloud Connector that allowed an authenticated administrator to set arbitrary connector attributes, including the “file“ attribute, which in turn allowed the user to access files uploaded for other sources.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Delimited File Connector — Cloud ConnectorAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-3318",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-3318",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-07-19T16:30:56.909490Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@sailpoint.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.2,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 0.5
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@sailpoint.com",
      "affectedData": [
        {
          "vendor": "SailPoint",
          "product": "Identity Security Cloud",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-05-15T16:15:10.963",
  "references": [
    {
      "url": "https://www.sailpoint.com/security-advisories/",
      "source": "psirt@sailpoint.com"
    },
    {
      "url": "https://www.sailpoint.com/security-advisories/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@sailpoint.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A file path traversal vulnerability was identified in the DelimitedFileConnector Cloud Connector that allowed an authenticated administrator to set arbitrary connector attributes, including the “file“ attribute, which in turn allowed the user to access files uploaded for other sources."
    },
    {
      "lang": "es",
      "value": "Se identificó una vulnerabilidad de path traversal de archivo en el conector en la nube DelimitedFileConnector que permitía a un administrador autenticado establecer atributos de conector arbitrarios, incluido el atributo “archivo”, lo que a su vez permitía al usuario acceder a archivos cargados para otras fuentes."
    }
  ],
  "lastModified": "2026-06-17T07:43:46.553",
  "sourceIdentifier": "psirt@sailpoint.com"
}