CVE-2024-40348

An issue in the component /api/swaggerui/static of Bazaar v1.4.3 allows unauthenticated attackers to execute a directory traversal.

CVSS v3.1

8.2 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

EPSS

8.29% chance of exploitation in the next 30 days, 95th percentile

Nuclei

high · CWE-22

Published

2024-07-20

Updated

2024-08-02

Proof-of-concept exploits (2)

• NingXin2002/Bazaar_poc0★ · 2024-12-20
• bigb0x/CVE-2024-4034831★ · 2024-07-21

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-40348.yaml

Exploit collections (1)

• zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2024/CVE-2024-40348.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2024-23692
• CVE-2024-27292
• CVE-2024-41319
• CVE-2022-32055
• CVE-2024-21514
• CVE-2024-24919