CVE-2024-24042: Path traversal in flaskcode Devan-Kerman ARRP

March 19, 2024

Directory Traversal vulnerability in Devan-Kerman ARRP v.0.8.1 and before allows a remote attacker to execute arbitrary code via the dumpDirect in RuntimeResourcePackImpl component.

References

gist.github.com/apple502j/193358682885fe1a6708309ce934e4ed
github.com/Devan-Kerman/ARRP
github.com/Devan-Kerman/ARRP/commit/7ea80db462c8bf66a0565e84fa49c1f2ecb9287b
github.com/advisories/GHSA-cg24-jjr5-rxmf
nvd.nist.gov/vuln/detail/CVE-2024-24042

Code Behaviors & Features

Detect and mitigate CVE-2024-24042 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →