CVE-2024-49381: Plenti arbitrary file deletion vulnerability
(updated )
Plenti, a static site generator, has an arbitrary file deletion vulnerability in versions prior to 0.7.2. The /postLocal endpoint is vulnerable to an arbitrary file write deletion when a plenti user serves their website. This issue may lead to information loss. Version 0.7.2 fixes the vulnerability.
References
- github.com/advisories/GHSA-6h8w-hrfp-pffx
- github.com/plentico/plenti
- github.com/plentico/plenti/blob/01825e0dcd3505fac57adc2edf29f772d585c008/cmd/serve.go
- github.com/plentico/plenti/releases/tag/v0.7.2
- nvd.nist.gov/vuln/detail/CVE-2024-49381
- securitylab.github.com/advisories/GHSL-2024-297_GHSL-2024-298_plenti
Code Behaviors & Features
Detect and mitigate CVE-2024-49381 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →