EUVD-2025-16684
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
4Description
Directory Traversal vulnerability in WebLaudos 24.2 (04) allows a remote attacker to obtain sensitive information via the id parameter.
Analysis
Directory Traversal vulnerability (CWE-22) in WebLaudos version 24.2 (04) that allows unauthenticated remote attackers to read arbitrary files and obtain sensitive information through improper validation of the 'id' parameter. With a CVSS score of 7.5 and network-based attack vector requiring no privileges or user interaction, this vulnerability poses a significant confidentiality risk to exposed WebLaudos instances. The vulnerability's active exploitation status and proof-of-concept availability should be verified through current KEV databases and security advisories.
Technical Context
Directory Traversal vulnerabilities (CWE-22) occur when an application fails to properly validate or sanitize user-supplied input used in file path operations, allowing attackers to escape intended directory boundaries using path traversal sequences (e.g., '../', '..\', or URL-encoded variants like '%2e%2e%2f'). In WebLaudos 24.2 (04), the vulnerable 'id' parameter is processed without adequate input validation, permitting attackers to traverse the file system hierarchy. WebLaudos is a document/clinical records management system commonly deployed in healthcare environments. The vulnerability likely affects the web application's file retrieval or document access functionality, where user-controlled parameters are passed directly to file system operations without canonicalization or allowlist validation. CPE string would be: cpe:2.3:a:weblaudos:weblaudos:24.2:*:*:*:*:*:*:*
Affected Products
WebLaudos (['24.2 (04)'])
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today