CVE-2024-11309: 
NixOS vulnerability analysis and mitigation

The DVC from TRCore has a Path Traversal vulnerability identified as CVE-2024-11309, which was discovered and disclosed on November 18, 2024. This vulnerability affects DVC versions 6.0 through 6.3. The issue allows unauthenticated remote attackers to read arbitrary system files on the affected systems (TWCERT Advisory).

The vulnerability is classified as a Path Traversal issue (CWE-22/CWE-23) with a CVSS v3.1 base score of 7.5 (High), and vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. This scoring indicates that the vulnerability can be exploited remotely without requiring authentication or user interaction, and primarily impacts the confidentiality of the system (NVD).

The vulnerability allows unauthorized access to arbitrary system files, potentially exposing sensitive information stored on the affected systems. The high confidentiality impact (C:H) in the CVSS score indicates that the vulnerability could lead to total information disclosure, with all system files potentially being revealed to the attacker (TWCERT Advisory).

The vulnerability can be exploited by unauthenticated remote attackers, requiring no special privileges or user interaction. The low attack complexity (AC:L) suggests that the vulnerability is straightforward to exploit, making it a significant security risk (NVD).

The vendor has released version 6.4 as a fix for this vulnerability. Users are advised to update to version 6.4 or later to mitigate the security risk (TWCERT Advisory).