CVE-2024-8685

Name of the Vulnerable Software and Affected Versions Revolution Pi version 2022-07-28-revpi-buster

Description The issue allows an authenticated attacker to list device directories via the "/pictory/php/getFileList.php" endpoint in the dir parameter. This could potentially be exploited to gain unauthorized access to sensitive information.

Recommendations For Revolution Pi version 2022-07-28-revpi-buster, consider disabling access to the "/pictory/php/getFileList.php" endpoint until a patch is available. Additionally, restrict the use of the dir parameter in this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.