What is the CVSS score of CVE-2024-26261?

CVE-2024-26261 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Oaklouds Organization 2 0 CVE-2024-26261

CRITICAL

Path Traversal (CWE-22)

2024-02-15 twcert@cert.org.tw

Path Traversal Oaklouds Organization 2 0 Oaklouds Organization 3 0 Oaklouds Webbase 2 0 Oaklouds Webbase 3 0

9.8

CVSS 3.1 · Vendor: cert

Severity by source

Vendor (cert) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (cert) · only source for this CVE.

CVSS VectorVendor: cert

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Feb 15, 2024 - 03:15 cve.org

CRITICAL 9.8

DescriptionCVE.org

The functionality for file download in HGiga OAKlouds' certain modules contains an Arbitrary File Read and Delete vulnerability. Attackers can put file path in specific request parameters, allowing them to download the file without login. Furthermore, the file will be deleted after being downloaded.

AnalysisAI

The functionality for file download in HGiga OAKlouds' certain modules contains an Arbitrary File Read and Delete vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Path Traversal (CWE-22), which allows attackers to access files and directories outside the intended path. The functionality for file download in HGiga OAKlouds' certain modules contains an Arbitrary File Read and Delete vulnerability. Attackers can put file path in specific request parameters, allowing them to download the file without login. Furthermore, the file will be deleted after being downloaded. Affected products include: Hgiga Oaklouds-Organization-2.0, Hgiga Oaklouds-Organization-3.0, Hgiga Oaklouds-Webbase-2.0, Hgiga Oaklouds-Webbase-3.0.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate and canonicalize file paths. Use chroot or sandboxing. Reject input containing path separators or '../' sequences.