CVE-2024-41628
HighCVSS 7.5Exploitation Probability (EPSS)
Very high risk93th percentile - higher than 93% of all known CVEs
Summary
A Directory Traversal vulnerability in Severalnines Cluster Control allows a remote attacker to read server files by manipulating paths in HTTP requests to the CMON API. The flaw affects versions before 1.9.8-9778, 2.0.0-9779, and 2.1.0-9780.
Risk Assessment
An attacker can access sensitive configuration files, credentials, or other confidential data stored on the server, potentially leading to privilege escalation or data leakage.
Recommendation
Immediately upgrade Cluster Control to version 1.9.8-9778, 2.0.0-9779, or 2.1.0-9780 depending on your branch. Restrict access to the CMON API to trusted networks only.
Original NVD description (English source)
Directory Traversal vulnerability in Severalnines Cluster Control 1.9.8 before 1.9.8-9778, 2.0.0 before 2.0.0-9779, and 2.1.0 before 2.1.0-9780 allows a remote attacker to include and display file content in an HTTP request via the CMON API.