medium5.3
CVE-2024-25125
Absolute path traversal vulnerability in digdag server
Impact
### Summary Treasure Data's digdag workload automation system is susceptible to a path traversal vulnerability if it's configured to store log files locally. ### Impact This issue may lead to Information Disclosure.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | io.digdag:digdag-server | < 0.10.5.1 | 0.10.5.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Treasuredata | Digdag | before 0.10.5.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/treasure-data/digdag/commit/eae89b0daf6c62f12309d8c7194454dfb18cc5c3
- https://github.com/treasure-data/digdag/security/advisories/GHSA-5mp4-32rr-v3x5
- https://github.com/advisories/GHSA-5mp4-32rr-v3x5
- https://nvd.nist.gov/vuln/detail/CVE-2024-25125