⚠ Exploited in the wild
Exploitation observed in the wild. Not yet on CISA KEV.
CVE-2024-23334 — Path Traversal in Aiohttp
Severity
7.5HIGHNVD
CNA5.9VulnCheck5.9
EPSS
93.5%
top 0.18%
CISA KEV
Not in KEV
Exploit
Exploited in wild
Active exploitation observed
Affected products
Timeline
PublishedJan 29
Latest updateFeb 4
Description
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'follow_symlinks' can be used to determine whether to follow symbolic links outside the static root directory. When 'follow_symlinks' is set to True, there is no validation to check if reading a file is within the root directory. This can lead to directory traversal vul…
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6
Affected Packages3 packages
Also affects: Fedora 39
Patches
🔴Vulnerability Details
5OSV▶
CVE-2024-23334: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python↗2024-01-29
VulnCheck
▶
💥Exploits & PoCs
2Nuclei▶
aiohttp - Directory Traversal
🔍Detection Rules
1Suricata
▶