CVE-2024-25975 (GCVE-0-2024-25975)
Vulnerability from cvelistv5 – Published: 2024-05-29 13:13 – Updated: 2025-02-13 17:40
VLAI
EPSS
VEX
Title
Arbitrary File Overwrite
Summary
The application implements an up- and downvote function which alters a value within a JSON file. The POST parameters are not filtered properly and therefore an arbitrary file can be overwritten. The file can be controlled by an authenticated attacker, the content cannot be controlled. It is possible to overwrite all files for which the webserver has write access. It is required to supply a relative path (path traversal).
Severity
6.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-30 18:19 UTC
CWE
- CWE-73 - External Control of File Name or Path
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://r.sec-consult.com/hawki | third-party-advisory |
| https://github.com/HAWK-Digital-Environments/HAWK… | patch |
| http://seclists.org/fulldisclosure/2024/May/34 |
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Interaction Design Team at the University of Applied Sciences and Arts in Hildesheim/Germany | HAWKI |
Affected:
versions before commit 146967f
(custom)
|
guessed | |
| hawki | hawki |
Affected:
0 , < commit_146967f
(custom)
cpe:2.3:a:hawki:hawki:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:hawki:hawki:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "hawki",
"vendor": "hawki",
"versions": [
{
"lessThan": "commit_146967f",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-25975",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-30T18:19:41.943503Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-06T14:49:52.060Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:52:06.397Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"third-party-advisory",
"x_transferred"
],
"url": "https://r.sec-consult.com/hawki"
},
{
"tags": [
"patch",
"x_transferred"
],
"url": "https://github.com/HAWK-Digital-Environments/HAWKI/commit/146967f3148e92d1640ffebc21d8914e2d7fb3f1"
},
{
"tags": [
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2024/May/34"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "HAWKI",
"repo": "https://github.com/HAWK-Digital-Environments/HAWKI",
"vendor": "Interaction Design Team at the University of Applied Sciences and Arts in Hildesheim/Germany",
"versions": [
{
"status": "affected",
"version": "versions before commit 146967f",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Florian Stuhlmann, Thorger Jansen (Office Bochum) | SEC Consult Vulnerability Lab"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003c/p\u003e\u003cp\u003eThe application implements an up- and downvote function which alters a value within a JSON file. The POST parameters are not filtered properly and therefore an arbitrary file can be overwritten. The file can be controlled by an authenticated attacker, the content cannot be controlled. It is possible to overwrite all files for which the webserver has write access. It is required to supply a relative path (path traversal).\u003c/p\u003e\u003cp\u003e\u003c/p\u003e"
}
],
"value": "The application implements an up- and downvote function which alters a value within a JSON file. The POST parameters are not filtered properly and therefore an arbitrary file can be overwritten. The file can be controlled by an authenticated attacker, the content cannot be controlled. It is possible to overwrite all files for which the webserver has write access. It is required to supply a relative path (path traversal)."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-73",
"description": "CWE-73 External Control of File Name or Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-10T16:10:16.276Z",
"orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf",
"shortName": "SEC-VLab"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://r.sec-consult.com/hawki"
},
{
"tags": [
"patch"
],
"url": "https://github.com/HAWK-Digital-Environments/HAWKI/commit/146967f3148e92d1640ffebc21d8914e2d7fb3f1"
},
{
"url": "http://seclists.org/fulldisclosure/2024/May/34"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe vendor provides a patch which can be downloaded from \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/HAWK-Digital-Environments/HAWKI/commit/146967f3148e92d1640ffebc21d8914e2d7fb3f1\"\u003ehttps://github.com/HAWK-Digital-Environments/HAWKI/commit/146967f3148e92d1640ffebc21d8914e2d7fb3f1\u003c/a\u003e\u003c/p\u003e\u003cbr\u003e"
}
],
"value": "The vendor provides a patch which can be downloaded from https://github.com/HAWK-Digital-Environments/HAWKI/commit/146967f3148e92d1640ffebc21d8914e2d7fb3f1"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Arbitrary File Overwrite",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf",
"assignerShortName": "SEC-VLab",
"cveId": "CVE-2024-25975",
"datePublished": "2024-05-29T13:13:14.625Z",
"dateReserved": "2024-02-13T09:28:28.809Z",
"dateUpdated": "2025-02-13T17:40:56.941Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2024-25975",
"date": "2026-09-17",
"epss": "0.00592",
"percentile": "0.46796"
},
"fkie_nvd": {
"descriptions": [
{
"lang": "en",
"value": "The application implements an up- and downvote function which alters a value within a JSON file. The POST parameters are not filtered properly and therefore an arbitrary file can be overwritten. The file can be controlled by an authenticated attacker, the content cannot be controlled. It is possible to overwrite all files for which the webserver has write access. It is required to supply a relative path (path traversal)."
},
{
"lang": "es",
"value": "La aplicaci\u00f3n implementa una funci\u00f3n de votaci\u00f3n a favor y en contra que altera un valor dentro de un archivo JSON. Los par\u00e1metros POST no se filtran correctamente y, por lo tanto, se puede sobrescribir un archivo arbitrario. El archivo puede ser controlado por un atacante autenticado, el contenido no puede ser controlado. Es posible sobrescribir todos los archivos para los que el servidor web tiene acceso de escritura. Es necesario proporcionar una ruta relativa (path traversa)."
}
],
"id": "CVE-2024-25975",
"lastModified": "2024-11-21T09:01:41.097",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
},
"published": "2024-05-29T14:15:21.793",
"references": [
{
"source": "551230f0-3615-47bd-b7cc-93e92e730bbf",
"url": "http://seclists.org/fulldisclosure/2024/May/34"
},
{
"source": "551230f0-3615-47bd-b7cc-93e92e730bbf",
"url": "https://github.com/HAWK-Digital-Environments/HAWKI/commit/146967f3148e92d1640ffebc21d8914e2d7fb3f1"
},
{
"source": "551230f0-3615-47bd-b7cc-93e92e730bbf",
"url": "https://r.sec-consult.com/hawki"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://seclists.org/fulldisclosure/2024/May/34"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://github.com/HAWK-Digital-Environments/HAWKI/commit/146967f3148e92d1640ffebc21d8914e2d7fb3f1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://r.sec-consult.com/hawki"
}
],
"sourceIdentifier": "551230f0-3615-47bd-b7cc-93e92e730bbf",
"vulnStatus": "Awaiting Analysis",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-73"
}
],
"source": "551230f0-3615-47bd-b7cc-93e92e730bbf",
"type": "Secondary"
}
]
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "affected",
"product": "HAWKI",
"repo": "https://github.com/HAWK-Digital-Environments/HAWKI",
"vendor": "Interaction Design Team at the University of Applied Sciences and Arts in Hildesheim/Germany",
"versions": [
{
"status": "affected",
"version": "versions before commit 146967f",
"versionType": "custom"
}
]
}
],
"source": "551230f0-3615-47bd-b7cc-93e92e730bbf"
},
{
"affectedData": [
{
"cpes": [
"cpe:2.3:a:hawki:hawki:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "hawki",
"vendor": "hawki",
"versions": [
{
"lessThan": "commit_146967f",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The application implements an up- and downvote function which alters a value within a JSON file. The POST parameters are not filtered properly and therefore an arbitrary file can be overwritten. The file can be controlled by an authenticated attacker, the content cannot be controlled. It is possible to overwrite all files for which the webserver has write access. It is required to supply a relative path (path traversal)."
},
{
"lang": "es",
"value": "La aplicaci\u00f3n implementa una funci\u00f3n de votaci\u00f3n a favor y en contra que altera un valor dentro de un archivo JSON. Los par\u00e1metros POST no se filtran correctamente y, por lo tanto, se puede sobrescribir un archivo arbitrario. El archivo puede ser controlado por un atacante autenticado, el contenido no puede ser controlado. Es posible sobrescribir todos los archivos para los que el servidor web tiene acceso de escritura. Es necesario proporcionar una ruta relativa (path traversa)."
}
],
"id": "CVE-2024-25975",
"lastModified": "2026-06-17T07:16:50.190",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2024-25975",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-30T18:19:41.943503Z",
"version": "2.0.3"
}
}
]
},
"published": "2024-05-29T14:15:21.793",
"references": [
{
"source": "551230f0-3615-47bd-b7cc-93e92e730bbf",
"url": "http://seclists.org/fulldisclosure/2024/May/34"
},
{
"source": "551230f0-3615-47bd-b7cc-93e92e730bbf",
"url": "https://github.com/HAWK-Digital-Environments/HAWKI/commit/146967f3148e92d1640ffebc21d8914e2d7fb3f1"
},
{
"source": "551230f0-3615-47bd-b7cc-93e92e730bbf",
"url": "https://r.sec-consult.com/hawki"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://seclists.org/fulldisclosure/2024/May/34"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://github.com/HAWK-Digital-Environments/HAWKI/commit/146967f3148e92d1640ffebc21d8914e2d7fb3f1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://r.sec-consult.com/hawki"
}
],
"sourceIdentifier": "551230f0-3615-47bd-b7cc-93e92e730bbf",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-73"
}
],
"source": "551230f0-3615-47bd-b7cc-93e92e730bbf",
"type": "Secondary"
}
]
}
},
"redhat_vex": {
"current_release_date": "2025-05-28T21:47:51+00:00",
"cve": "CVE-2024-25975",
"id": "CVE-2024-25975",
"initial_release_date": "2024-01-01T00:00:00+00:00",
"product_status:known_not_affected": "1",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "Arbitrary File Overwrite",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-25975.json",
"version": "3"
},
"vulnrichment": {
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:52:06.397Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"third-party-advisory",
"x_transferred"
],
"url": "https://r.sec-consult.com/hawki"
},
{
"tags": [
"patch",
"x_transferred"
],
"url": "https://github.com/HAWK-Digital-Environments/HAWKI/commit/146967f3148e92d1640ffebc21d8914e2d7fb3f1"
},
{
"tags": [
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2024/May/34"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:hawki:hawki:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "hawki",
"vendor": "hawki",
"versions": [
{
"lessThan": "commit_146967f",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-25975",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-30T18:19:41.943503Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-05-30T18:30:15.492Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "HAWKI",
"repo": "https://github.com/HAWK-Digital-Environments/HAWKI",
"vendor": "Interaction Design Team at the University of Applied Sciences and Arts in Hildesheim/Germany",
"versions": [
{
"status": "affected",
"version": "versions before commit 146967f",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Florian Stuhlmann, Thorger Jansen (Office Bochum) | SEC Consult Vulnerability Lab"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003c/p\u003e\u003cp\u003eThe application implements an up- and downvote function which alters a value within a JSON file. The POST parameters are not filtered properly and therefore an arbitrary file can be overwritten. The file can be controlled by an authenticated attacker, the content cannot be controlled. It is possible to overwrite all files for which the webserver has write access. It is required to supply a relative path (path traversal).\u003c/p\u003e\u003cp\u003e\u003c/p\u003e"
}
],
"value": "The application implements an up- and downvote function which alters a value within a JSON file. The POST parameters are not filtered properly and therefore an arbitrary file can be overwritten. The file can be controlled by an authenticated attacker, the content cannot be controlled. It is possible to overwrite all files for which the webserver has write access. It is required to supply a relative path (path traversal)."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-73",
"description": "CWE-73 External Control of File Name or Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-10T16:10:16.276Z",
"orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf",
"shortName": "SEC-VLab"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://r.sec-consult.com/hawki"
},
{
"tags": [
"patch"
],
"url": "https://github.com/HAWK-Digital-Environments/HAWKI/commit/146967f3148e92d1640ffebc21d8914e2d7fb3f1"
},
{
"url": "http://seclists.org/fulldisclosure/2024/May/34"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe vendor provides a patch which can be downloaded from \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/HAWK-Digital-Environments/HAWKI/commit/146967f3148e92d1640ffebc21d8914e2d7fb3f1\"\u003ehttps://github.com/HAWK-Digital-Environments/HAWKI/commit/146967f3148e92d1640ffebc21d8914e2d7fb3f1\u003c/a\u003e\u003c/p\u003e\u003cbr\u003e"
}
],
"value": "The vendor provides a patch which can be downloaded from https://github.com/HAWK-Digital-Environments/HAWKI/commit/146967f3148e92d1640ffebc21d8914e2d7fb3f1"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Arbitrary File Overwrite",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf",
"assignerShortName": "SEC-VLab",
"cveId": "CVE-2024-25975",
"datePublished": "2024-05-29T13:13:14.625Z",
"dateReserved": "2024-02-13T09:28:28.809Z",
"dateUpdated": "2025-02-13T17:40:56.941Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…