Allegra downloadExportedChart Directory Traversal Authentication Bypass Vulnerability
CVE-2023-51639

9.8CRITICAL

Key Information:

Vendor

Allegra

Status
Allegra
Vendor
CVE Published:
22 November 2024

What is CVE-2023-51639?

The Allegra application by TrackPlus is vulnerable to a directory traversal authentication bypass, specifically in the downloadExportedChart functionality. The flaw stems from insufficient validation of user-supplied paths, allowing attackers to manipulate file operations without requiring authentication. This vulnerability poses significant security risks, enabling unauthorized access to sensitive data and possible exploitation by remote attackers, making it essential for affected users to take immediate action to secure their installations.

Affected Version(s)

Allegra 7.5.0.24

References

https://www.zerodayinitiative.com/advisories/ZDI-24-110/
x_research-advisory
https://www.trackplus.com/en/service/release-notes-reader...
vendor-advisory

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

CVSS V3.0

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.