CVE-2024-39303

CVSS V2 None CVSS V3 None

Description

Weblate is a web based localization tool. Prior to version 5.6.2, Weblate didn't correctly validate filenames when restoring project backup. It may be possible to gain unauthorized access to files on the server using a crafted ZIP file. This issue has been addressed in Weblate 5.6.2. As a workaround, do not allow untrusted users to create projects.

Overview

CVE ID
CVE-2024-39303

Assigner
GitHub_M

Vulnerability Status
PUBLISHED

Published Version
2024-07-01T18:46:18.183Z

Last Modified Date
2024-07-01T20:50:32.040Z

Weakness Enumerations

CWE	URL
CWE-73	http://cwe.mitre.org/data/definitions/73.html

References

Reference URL	Reference Tags
https://github.com/WeblateOrg/weblate/security/advisories/GHSA-jfgp-674x-6q4p	x_refsource_CONFIRM
https://github.com/WeblateOrg/weblate/commit/b6a7eace155fa0feaf01b4ac36165a9c5e63bfdd	x_refsource_MISC

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2024-39303
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39303

History

Created	Old Value	New Value	Data Type	Notes
2024-07-02 13:11:46				Added to TrackCVE