CVE-2024-4701
published 2024-05-14CVE-2024-4701: A path traversal issue potentially leading to remote code execution in Genie for all versions prior to 4.3.18
PriorityP278critical9.9CVSS 3.1
AVNACLPRLUINSCCHIHAL
EPSS
24.63%
97.6th percentile
A path traversal issue potentially leading to remote code execution in Genie for all versions prior to 4.3.18
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| netflix | genie | <= 4.3.18 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Genie Path Traversal vulnerability via File Uploads
ghsa·2024-05-09
CVE-2024-4701 [CRITICAL] CWE-22 Genie Path Traversal vulnerability via File Uploads
Genie Path Traversal vulnerability via File Uploads
### Overview
Path Traversal Vulnerability via File Uploads in Genie
### Impact
Any Genie OSS users running their own instance and relying on the filesystem to store file attachments submitted to the Genie application may be impacted. Using this technique, it is possible to write a file with any user-specified filename and file contents to any location on the file system that the Java process has write access - potentially leading to remote code execution (RCE).
Genie users who do not store these attachments locally on the underlying file system are not vulnerable to this issue.
### Description
Genie's API accepts a multipart/form-data file upload which can be saved to a location on disk. However, it takes a user-supplied filename as p
OSV
Genie Path Traversal vulnerability via File Uploads
osv·2024-05-09
CVE-2024-4701 [CRITICAL] Genie Path Traversal vulnerability via File Uploads
Genie Path Traversal vulnerability via File Uploads
### Overview
Path Traversal Vulnerability via File Uploads in Genie
### Impact
Any Genie OSS users running their own instance and relying on the filesystem to store file attachments submitted to the Genie application may be impacted. Using this technique, it is possible to write a file with any user-specified filename and file contents to any location on the file system that the Java process has write access - potentially leading to remote code execution (RCE).
Genie users who do not store these attachments locally on the underlying file system are not vulnerable to this issue.
### Description
Genie's API accepts a multipart/form-data file upload which can be saved to a location on disk. However, it takes a user-supplied filename as p
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-05-14
Published