CVE-2024-51483: dgtlmoon changedetection.io Path Traversal

Vulnerability summary

CVE-2024-51483 is a medium (CVSS 6.9) Path Traversal vulnerability in dgtlmoon changedetection.io. EPSS estimates a 2.27% chance of exploitation in the next 30 days, higher than 82.9% of scored vulnerabilities.

Timeline

1. 01-11-2024
   PublishedVulnerability first disclosed.
2. 01-11-2024
   Last modifiedVulnerability information updated.

Description

changedetection.io is free, open source web page change detection software. Prior to version 0.47.5, when a WebDriver is used to fetch files, `source:file:///etc/passwd` can be used to retrieve local system files, where the more traditional `file:///etc/passwd` gets blocked. Version 0.47.5 fixes the issue.

• CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.