RaspAP WebGUI Vulnerability Allows Remote Access to /etc/passwd File
CVE-2024-28753

6.5MEDIUM

Key Information:

Vendor

RaspAP

Status
Raspap
Vendor
CVE Published:
9 March 2024

What is CVE-2024-28753?

A vulnerability has been identified in RaspAP, which affects version 3.0.9 of the web-based interface. This flaw allows remote attackers to send specially crafted requests that can lead to the exposure of the /etc/passwd file. The sensitive information contained within this file can provide attackers with critical insights into the system's user accounts and configuration, posing a significant risk to the integrity and security of affected installations.

References

https://dustri.org/b/carrot-disclosure.html

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.