CVE-2024-34524

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-34524
In XLANG OpenAgents through fe73ac4, the allowed_file protection mechanism can be bypassed by using an incorrect file extension for the nature of the file content.

9.1 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/xlang-ai/OpenAgents/blob/880e26adfe380e999962fc645fc8fc80bd72f103/backend/utils/utils.py#L31
https://github.com/xlang-ai/OpenAgents/issues/112
https://github.com/xlang-ai/OpenAgents/blob/880e26adfe380e999962fc645fc8fc80bd72f103/backend/utils/utils.py#L31
https://github.com/xlang-ai/OpenAgents/issues/112
Configurations

No configuration.

History

21 Nov 2024, 09:18

Type Values Removed Values Added
References () https://github.com/xlang-ai/OpenAgents/blob/880e26adfe380e999962fc645fc8fc80bd72f103/backend/utils/utils.py#L31 - () https://github.com/xlang-ai/OpenAgents/blob/880e26adfe380e999962fc645fc8fc80bd72f103/backend/utils/utils.py#L31 -
References () https://github.com/xlang-ai/OpenAgents/issues/112 - () https://github.com/xlang-ai/OpenAgents/issues/112 -

03 Jul 2024, 02:00

Type Values Removed Values Added
CWE CWE-288
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.1
Summary
  • (es) En XLANG OpenAgents hasta fe73ac4, el mecanismo de protección de archivos permitidos se puede omitir utilizando una extensión de archivo incorrecta para la naturaleza del contenido del archivo.

06 May 2024, 00:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-06 00:15

Updated : 2024-11-21 09:18

NVD link : CVE-2024-34524

Mitre link : CVE-2024-34524

CVE.ORG link : CVE-2024-34524

JSON object : View

Products Affected

No product.

CWE
CWE-288

Authentication Bypass Using an Alternate Path or Channel