CVE-2024-36527

puppeteer-renderer v.3.2.0 and before is vulnerable to Directory Traversal. Attackers can exploit the URL parameter using the file protocol to read sensitive information from the server.

CVSS v3.1 CNA

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

2.58% chance of exploitation in the next 30 days, 85th percentile

Nuclei

medium

Published

2024-06-17

Updated

2024-08-02

Proof-of-concept exploits (1)

• bigb0x/CVE-2024-365271★ · 2024-06-22

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-36527.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2022-32055
• CVE-2024-21514
• CVE-2024-24919
• CVE-2024-28995
• CVE-2024-29973
• CVE-2024-31982