Path Traversal Vulnerability in Pluck CMS Allows Unauthorized Access to Sensitive Information

CVE-2024-9405

What is CVE-2024-9405?

A vulnerability exists in Pluck CMS due to an incorrect limitation of the path to a restricted directory, allowing unauthorized access. Attackers can exploit this weakness to extract sensitive information from the server by accessing the absolute path of files located within the same directory or its subdirectories, while access to files in recursive directories is restricted. This flaw impacts the overall security posture of web applications using the affected version, highlighting the importance of robust directory access controls in web application security.

References