CVE-2024-9405: 
Pluck CMS vulnerability analysis and mitigation

An incorrect limitation of a path to a restricted directory (path traversal) vulnerability has been discovered in Pluck CMS version 4.7.18. The vulnerability was discovered by David Utón Amaya and has been assigned CVE-2024-9405. The issue was disclosed on January 10, 2024, and received a CVSS v3.1 base score of 5.3 (Medium severity) (INCIBE Notice).

The vulnerability is classified as CWE-23 (Relative Path Traversal) and has been assigned a CVSS v3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. This indicates that the vulnerability can be exploited remotely, requires low attack complexity, needs no privileges, requires no user interaction, has unchanged scope, and can result in low confidentiality impact with no effects on integrity or availability (INCIBE Notice).

The vulnerability allows an unauthenticated attacker to extract sensitive information from the server via the absolute path of a file located in the same directory or subdirectory as the module. However, the access is limited to files within the same directory or subdirectory, and does not extend to recursive directories (INCIBE Notice).

As of the vulnerability disclosure, no official solution or patch has been reported for this security issue (INCIBE Notice).