{"affected":[{"defaultStatus":"affected","product":"Huatian Dynamic OA8000","source":"CNA: VulnCheck","vendor":"Dalian Huatian Software Co., Ltd.","versions":[{"status":"affected","version":"0","versionType":"custom"}]}],"cveId":"CVE-2024-58406","cwes":["CWE-22"],"description":"Huatian Dynamic OA8000 collaborative office system contains an unauthenticated path traversal vulnerability in /OAapp/jsp/trace/ntkodownload.jsp, where the filename request parameter is used to locate a file without restricting access to an intended directory or rejecting traversal sequences. Attackers can supply ../ sequences to read arbitrary files from the server, such as the Tomcat configuration at ROOT/WEB-INF/web.xml, exposing sensitive configuration, source, and credential material that can enable further compromise. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-11-20.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: VulnCheck","url":"https://cn-sec.com/archives/2540697.html"}],"kev":null,"metrics":[{"score":8.7,"severity":"high","source":"CNA: VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0"},{"score":7.5,"severity":"high","source":"CNA: VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}],"modifiedAt":1794585433779,"publishedAt":1794585433779,"references":[{"source":"CNA: VulnCheck","tags":["technical-description","exploit"],"url":"https://cn-sec.com/archives/2540697.html"},{"source":"CNA: VulnCheck","tags":["product"],"url":"https://www.oa8000.com/"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/huatian-oa8000-path-traversal-via-ntkodownload-jsp"}],"remediation":[],"revision":"179ef548b09df227c07885a8efa87feccc2558d3444897aa2d6dcf68b290da11","sources":[{"modifiedAt":1794585433779,"name":"CNA: VulnCheck","retrievedAt":1794586098536,"url":"https://www.cve.org/CVERecord?id=CVE-2024-58406"}],"ssvc":null,"status":"published","title":"Huatian OA8000 Path Traversal via ntkodownload.jsp","updatedAt":1794586098536}