Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2024-46987
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Arbitrary path traversal in Camaleon CMS
Source: NVD (National Vulnerability Database)
Vulnerability Description
Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. A path traversal vulnerability accessible via MediaController's download_private_file method allows authenticated users to download any file on the web server Camaleon CMS is running on (depending on the file permissions). This issue may lead to Information Disclosure. This issue has been addressed in release version 2.8.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
信息暴露
Source: NVD (National Vulnerability Database)
Vulnerability Title
CamaleonCMS 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
CamaleonCMS是CamaleonCMS团队的一套基于RubyonRails的高级动态内容管理系统（CMS）。 CamaleonCMS 2.8.0版本存在信息泄露漏洞，该漏洞源于存在路径遍历漏洞，允许经过身份验证的用户下载服务器上的任何文件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
VendorProductAffected VersionsCPESubscribe
owen2345camaleon-cms < 2.8.2 -
II. Public POCs for CVE-2024-46987
#POC DescriptionSource LinkShenlong Link
1This Python PoC exploits CVE-2024-46987, a Path Traversal bug in Camaleon CMS 2.8.0 < 2.8.2 (work on 2.9.0). It allows authenticated users to read sensitive server files via the MediaController. Intended for authorized security auditing and educational research only. https://github.com/Goultarde/CVE-2024-46987POC Details
2Path Traversal vulnerabilityhttps://github.com/L1337Xi/CVE-2024-46987POC Details
3Nonehttps://github.com/Ik0nw/CVE-2024-46987POC Details
4Exploit for CVE-2024-46987https://github.com/sparrowhawk1113/Exploit-for-CVE-2024-46987POC Details
5CVE-2024-46987 - Camaleon CMS LFI Exploithttps://github.com/Rival420/CVE-2024-46987POC Details
6Exploit created using Pythonhttps://github.com/advaitpathak21/CVE-2024-46987POC Details
7This Rust PoC exploits CVE-2024-46987, a Path Traversal bug in Camaleon CMS 2.8.0 < 2.8.2 (work on 2.9.0).https://github.com/rabouzia/CVE-2024-46987POC Details
8PoC exploit for CVE-2024-46987 — Camaleon CMS arbitrary path traversal (file read)https://github.com/BLUEBERRYP1LL/CVE-2024-46987POC Details
AI-Generated POCPremium

No public POC found.

Login to generate AI POC
III. Intelligence Information for CVE-2024-46987
Please Login to view more intelligence information
IV. Related Vulnerabilities
Same product: camaleon-cms
Same vendor: owen2345
Same weakness: CWE-200
V. Comments for CVE-2024-46987

No comments yet

Leave a comment