CVE-2024-7340 — W&B Weave server remote arbitrary file leak and privilege escalation
The Weave server API allows remote users to fetch files from a specific directory, but due to a lack of input validation, it is possible to traverse and leak arbitrary files rem…
Published: 2024-07-31 · CVSS: 8.8 · CVSS 3.1
The Weave server API allows remote users to fetch files from a specific directory, but due to a lack of input validation, it is possible to traverse and leak arbitrary files remotely. In various common scenarios, this allows a low-privileged user to assume the role of the server admin.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7