CVE-2024-39303

Weblate is a web based localization tool. Prior to version 5.6.2, Weblate didn't correctly validate filenames when restoring project backup. It may be possible to gain unauthorized access to files on the server using a crafted ZIP file. This issue has been addressed in Weblate 5.6.2. As a workaround, do not allow untrusted users to create projects.
Configurations

Configuration 1 (hide)

cpe:2.3:a:weblate:weblate:*:*:*:*:*:*:*:*

History

21 Aug 2024, 15:54

Type Values Removed Values Added
CWE NVD-CWE-Other
CPE cpe:2.3:a:weblate:weblate:*:*:*:*:*:*:*:*
First Time Weblate
Weblate weblate
References () https://github.com/WeblateOrg/weblate/commit/b6a7eace155fa0feaf01b4ac36165a9c5e63bfdd - () https://github.com/WeblateOrg/weblate/commit/b6a7eace155fa0feaf01b4ac36165a9c5e63bfdd - Patch
References () https://github.com/WeblateOrg/weblate/security/advisories/GHSA-jfgp-674x-6q4p - () https://github.com/WeblateOrg/weblate/security/advisories/GHSA-jfgp-674x-6q4p - Patch, Vendor Advisory
CVSS v2 : unknown
v3 : 4.4
v2 : unknown
v3 : 5.4

02 Jul 2024, 12:09

Type Values Removed Values Added
Summary
  • (es) Weblate es una herramienta de localización basada en web. Antes de la versión 5.6.2, Weblate no validaba correctamente los nombres de archivos al restaurar la copia de seguridad del proyecto. Es posible obtener acceso no autorizado a archivos en el servidor utilizando un archivo ZIP manipulado. Este problema se ha solucionado en Weblate 5.6.2. Como workaround, no permita que usuarios que no sean de confianza creen proyectos.

01 Jul 2024, 19:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-07-01 19:15

Updated : 2024-08-21 15:54


NVD link : CVE-2024-39303

Mitre link : CVE-2024-39303

CVE.ORG link : CVE-2024-39303


JSON object : View

Products Affected

weblate

  • weblate
CWE
NVD-CWE-Other CWE-73

External Control of File Name or Path