PT-2024-38274

CVE-2024-7340

Published

2024-07-31

Updated

2026-07-07

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Weave server (affected versions not specified)

Description The Weave server API allows remote users to fetch files from a specific directory, but due to a lack of input validation, it is possible to traverse and leak arbitrary files remotely. In various common scenarios, this allows a low-privileged user to assume the role of the server admin. The issue is being actively exploited.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Natan Nehorai

Uriya Yavnieli

Vendors

Affected products

Weakness enumeration

CWE-20: Improper Input Validation

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')