Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2024-11314
CVE-2024-11314:
NixOS vulnerability analysis and mitigation
Overview
The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files, identified as CVE-2024-11314. This vulnerability affects DVC versions 6.0 through 6.3. The vulnerability was discovered and reported by Kun Xian Lin from DEVCORE and was publicly disclosed on November 18, 2024. The issue has been assigned a Critical CVSS v3.1 score of 9.8 (TWCERT/CC).
Technical details
The vulnerability combines two critical security weaknesses: Path Traversal (CWE-22/CWE-23) and Unrestricted Upload of File with Dangerous Type (CWE-434). The vulnerability allows unauthenticated remote attackers to upload arbitrary files to any directory on the system. The severity is reflected in its CVSS v3.1 score of 9.8 (Critical) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network accessibility, low attack complexity, and no required privileges or user interaction (NVD).
Impact
The vulnerability enables attackers to upload arbitrary files to any directory on the affected system. Most critically, attackers can upload webshells, leading to arbitrary code execution on the target system. This level of access could potentially result in complete system compromise (TWCERT/CC).
Mitigation and workarounds
Users are advised to update to DVC version 6.4 or later to address this vulnerability (TWCERT/CC).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management