DVC Path Traversal Vulnerability Leads to Arbitrary Code Execution
CVE-2024-11315

9.8CRITICAL

Key Information:

Vendor

Trcore

Status
Dvc
Vendor
CVE Published:
18 November 2024

What is CVE-2024-11315?

The DVC product from TRCore is identified to have a path traversal vulnerability that permits unauthenticated remote attackers to upload arbitrary files to any directory on the server. This flaw arises from the lack of restrictions on the types of files that can be uploaded, creating an opportunity for attackers to deploy malicious webshells. The vulnerability highlights significant security risks, compromising the integrity and confidentiality of affected systems. Users and administrators are advised to apply the latest security patches to mitigate this risk effectively.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

DVC 6.0 <= 6.3

References

https://www.twcert.org.tw/tw/cp-132-8254-8daa2-1.html
third-party-advisory
https://www.twcert.org.tw/en/cp-139-8255-0bb1a-2.html
third-party-advisory

EPSS Score

5% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.