VULNERABILITY INTELLIGENCE

CVE-2024-23822

CVSS score5.4 MEDIUM

EPSS probability1.44%

CISA KEVNot currently listed

Published2024-01-29

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Description

Thruk is a multibackend monitoring webinterface. Prior to 3.12, the Thruk web monitoring application presents a vulnerability in a file upload form that allows a threat actor to arbitrarily upload files to the server to any path they desire and have permissions for. This vulnerability is known as Path Traversal or Directory Traversal. Version 3.12 fixes the issue.

Weakness classification

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Primary references

security-advisories@github.com — Patch
security-advisories@github.com — Exploit, Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Patch, Vendor Advisory