NVIDIA Mellanox OS CGI Path Traversal Escalation Risk
CVE-2024-0113 Published on August 12, 2024
NVIDIA Mellanox OS, ONYX, Skyway, and MetroX-3 XCC contain a vulnerability in the web support, where an attacker can cause a CGI path traversal by a specially crafted URI. A successful exploit of this vulnerability might lead to escalation of privileges and information disclosure.
Vulnerability Analysis
CVE-2024-0113 can be exploited with network access, requires user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Type
Path Traversal: '.../...//'
The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory.
Products Associated with CVE-2024-0113
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2024-0113 are published in these products:
Affected Versions
NVIDIA Mellanox OS:- Version All versions prior to and including 3.11.4000 is affected.
- Version All versions prior to and including 3.11.2200 is affected.
- Version All versions prior to and including 3.10.4400 is affected.
- Version All versions prior to and including 8.2.2200 is affected.
- Version All versions prior to and including 8.1.4400 is affected.
- Version All versions prior to and including 18.2.2200 is affected.
- Version All versions prior to and including 3.11.4000 is affected.
- Before and including 3.11.4000 is affected.
- Before and including 3.11.2200 is affected.
- Before and including 3.10.4400 is affected.
- Before and including 8.2.2200 is affected.
- Before and including 8.1.4400 is affected.
- Before and including 3.11.4000 is affected.
- Before and including 18.2.2200 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.