6.5
CVE-2024-31450
- EPSS 0.97%
- Veröffentlicht 19.04.2024 19:15:06
- Zuletzt bearbeitet 15.10.2025 14:59:59
- Quelle security-advisories@github.com
- CVE-Watchlists
- Unerledigt
Owncast vulnerable to arbitrary file deletion in emoji.go (GHSL-2023-277)
Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. The Owncast application exposes an administrator API at the URL /api/admin. The emoji/delete endpoint of said API allows administrators to delete custom emojis, which are saved on disk. The parameter name is taken from the JSON request and directly appended to the filepath that points to the emoji to delete. By using path traversal sequences (../), attackers with administrative privileges can exploit this endpoint to delete arbitrary files on the system, outside of the emoji directory. This vulnerability is fixed in 0.1.3.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Owncast Project ≫ Owncast Version < 0.1.3
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.97% | 0.572 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 6.5 | 1.2 | 5.2 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
|
| security-advisories@github.com | 2.7 | 1.2 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
|
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
https://github.com/owncast/owncast/blob/v0.1.2/controllers/admin/emoji.go#L63
https://github.com/owncast/owncast/commit/1b14800c7d7f54be14ed4d130bfe7f480645076e
https://github.com/owncast/owncast/releases/tag/v0.1.3
https://securitylab.github.com/advisories/GHSL-2023-277_Owncast/