critical9.8
CVE-2024-5262
Files or Directories Accessible to External Parties in ProjectDiscovery
Impact
Files or Directories Accessible to External Parties vulnerability in smb server in ProjectDiscovery Interactsh allows remote attackers to read/write any files in the directory and subdirectories of where the victim runs interactsh-server via anonymous login.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/projectdiscovery/interactsh | < 1.2.0 | 1.2.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Projectdiscovery | Interactsh | from 0.0.6 before 1.2.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/projectdiscovery/interactsh/pull/874
- https://zuso.ai/advisory/za-2024-01
- https://github.com/advisories/GHSA-q5mg-pc7r-r8cr
- https://nvd.nist.gov/vuln/detail/CVE-2024-5262
- https://github.com/projectdiscovery/interactsh/commit/6a0cb98b16636a98712729f3d23e34d8bf7260e7
- https://pkg.go.dev/vuln/GO-2024-2907