Home

Description

A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API. This leads to improper handling of path traversal, insecure forwarding to an AJP backend without adequate validation, and lack of authentication for accessing internal API endpoints.

PUBLISHED Reserved 2024-11-20 | Published 2024-11-29 | Updated 2024-11-29 | Assigner trellix




HIGH: 8.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Problem types

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Product status

Default status
unaffected

11.6.12
affected

Credits

Rafal Gill reporter

References

thrive.trellix.com/s/article/000014058

cve.org (CVE-2024-11481)

nvd.nist.gov (CVE-2024-11481)

Download JSON