CVE-2024-46446

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-46446

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-46446.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-46446

Published

2024-10-07T00:00:00Z

Modified

2026-07-15T01:49:08.451274642Z

Severity

9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Summary

[none]

Details

Mecha CMS 3.0.0 is vulnerable to Directory Traversal. An attacker can construct cookies and URIs that bypass user identity checks. Parameters can then be passed through the POST method, resulting in the Deletion of Arbitrary Files or Website Takeover.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/46xxx/CVE-2024-46446.json",
    "cna_assigner": "mitre"
}

References

Affected packages

Git / github.com/mecha-cms/mecha

Affected ranges

Type

GIT

Repo

https://github.com/mecha-cms/mecha

Events

Introduced

0515241f31be6006aa4dd279ef900cac7442721e

Last affected

0515241f31be6006aa4dd279ef900cac7442721e

Database specific

{
    "cpe": "cpe:2.3:a:mecha-cms:mecha:3.0.0:*:*:*:*:*:*:*",
    "source": "CPE_STRING",
    "extracted_events": [
        {
            "introduced": "3.0.0"
        },
        {
            "last_affected": "3.0.0"
        }
    ]
}

Affected versions

3.*

3.0.0

v3.*

v3.0.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-46446.json"