GHSA-gfqf-9w98-7jmx

Stimulsoft Dashboard.JS directory traversal vulnerability

Source: GitHub Advisory Database (reviewed) Critical CVE-2024-24398

Packages

Ecosystem	Package	Affected	Fixed in
npm	stimulsoft-dashboards-js	< 2024.1.3	2024.1.3

Details

As written in the advisory (Markdown source, shown as plain text).

Directory Traversal vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.3 allows a remote attacker to execute arbitrary code via a crafted payload to the fileName parameter of the Save function.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-24398 advisory
https://cloud-trustit.spp.at/s/Pi78FFazHamJQ5R web
https://cves.at/posts/cve-2024-24398/writeup web
https://github.com/stimulsoft/Dashboards.JS package
http://stimulsoft.com web