CVE-2024-48862

published 2024-11-22

CVE-2024-48862: A link following vulnerability has been reported to affect QuLog Center. If exploited, the vulnerability could allow remote attackers to traverse the file…

Priority P3 57 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

A link following vulnerability has been reported to affect QuLog Center. If exploited, the vulnerability could allow remote attackers to traverse the file system to unintended locations and read or overwrite the contents of unexpected files.

We have already fixed the vulnerability in the following versions:
QuLog Center 1.7.0.831 ( 2024/10/15 ) and later
QuLog Center 1.8.0.888 ( 2024/10/15 ) and later

Affected

4 ranges

Vendor	Product	Version range	Fixed in
qnap	qulog_center	>= 1.7.0.800 < 1.7.0.831	1.7.0.831
qnap	qulog_center	>= 1.8.0.872 < 1.8.0.888	1.8.0.888
qnap_systems_inc	qulog_center	>= 1.7.x.x < 1.7.0.831 ( 2024/10/15 )	1.7.0.831 ( 2024/10/15 )
qnap_systems_inc	qulog_center	>= 1.8.x.x < 1.8.0.888 ( 2024/10/15 )	1.8.0.888 ( 2024/10/15 )

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v4.0 8.7 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-59