CVE-2024-25006

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-25006
XenForo before 2.2.14 allows Directory Traversal (with write access) by an authenticated user who has permissions to administer styles, and uses a ZIP archive for Styles Import.

8.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://xenforo.com/community/threads/xenforo-2-2-14-released.219044/ Release Notes
https://xenforo.com/docs/xf2/permissions/ Product
https://xenforo.com/tickets/BC37EB98/?v=5da7bd5728 Issue Tracking Product
https://xenforo.com/community/threads/xenforo-2-2-14-released.219044/ Release Notes
https://xenforo.com/docs/xf2/permissions/ Product
https://xenforo.com/tickets/BC37EB98/?v=5da7bd5728 Issue Tracking Product
Configurations

Configuration 1 (hide)

cpe:2.3:a:xenforo:xenforo:*:*:*:*:*:*:*:*
History

08 May 2025, 22:45

Type Values Removed Values Added
References () https://xenforo.com/community/threads/xenforo-2-2-14-released.219044/ - () https://xenforo.com/community/threads/xenforo-2-2-14-released.219044/ - Release Notes
References () https://xenforo.com/docs/xf2/permissions/ - () https://xenforo.com/docs/xf2/permissions/ - Product
References () https://xenforo.com/tickets/BC37EB98/?v=5da7bd5728 - () https://xenforo.com/tickets/BC37EB98/?v=5da7bd5728 - Issue Tracking, Product
CPE cpe:2.3:a:xenforo:xenforo:*:*:*:*:*:*:*:*
First Time Xenforo xenforo
Xenforo

21 Nov 2024, 09:00

Type Values Removed Values Added
References () https://xenforo.com/community/threads/xenforo-2-2-14-released.219044/ - () https://xenforo.com/community/threads/xenforo-2-2-14-released.219044/ -
References () https://xenforo.com/docs/xf2/permissions/ - () https://xenforo.com/docs/xf2/permissions/ -
References () https://xenforo.com/tickets/BC37EB98/?v=5da7bd5728 - () https://xenforo.com/tickets/BC37EB98/?v=5da7bd5728 -

01 Aug 2024, 13:47

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.1
CWE CWE-22
Summary
  • (es) XenForo anterior a 2.2.14 permite el Directory Traversal (con acceso de escritura) por parte de un usuario autenticado que tiene permisos para administrar estilos y utiliza un archivo ZIP para importar estilos.

29 Feb 2024, 01:44

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-29 01:44

Updated : 2025-05-08 22:45

NVD link : CVE-2024-25006

Mitre link : CVE-2024-25006

CVE.ORG link : CVE-2024-25006

JSON object : View

Products Affected

xenforo

  • xenforo
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')