CVE-2024-53982

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-53982
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-53982.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-53982
Aliases
  • GHSA-93rv-45r8-h5j4
Published
2024-12-04T22:20:53Z
Modified
2025-10-22T18:44:47.708224Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Arbitrary file download in Zoo-Project Echo Example
Details

ZOO-Project is a C-based WPS (Web Processing Service) implementation. A path traversal vulnerability was discovered in Zoo-Project Echo example. The Echo example available by default in Zoo installs implements file caching, which can be controlled by user-given parameters. No input validation is performed in this parameter, which allows an attacker to fully control the file which is returned in the response. Patch was committed in November 22nd, 2024.

Database specific 
{
    "cwe_ids": [
        "CWE-434"
    ]
}
References

Affected packages

Git / github.com/zoo-project/zoo-project

Affected ranges

Type
GIT
Repo
https://github.com/zoo-project/zoo-project
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
641cb18fec58de43a3468f314e5f8808c560e6d9

Affected versions

rel-1.*

rel-1.9.0
rel-1.9.0-rc1

rel-2.*

rel-2.0.0
rel-2.0.0-rc1
rel-2.0.0-rc2

Database specific

vanir_signatures

[
    {
        "source": "https://github.com/zoo-project/zoo-project/commit/641cb18fec58de43a3468f314e5f8808c560e6d9",
        "target": {
            "file": "zoo-project/zoo-kernel/caching.h"
        },
        "signature_type": "Line",
        "deprecated": false,
        "id": "CVE-2024-53982-0bd0050a",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "127283175583593385391957649133598910272",
                "143226284996406667744501548837142143628",
                "188535622569166075436823905335080922237",
                "166012312153109188333970129992565842020"
            ],
            "threshold": 0.9
        }
    },
    {
        "source": "https://github.com/zoo-project/zoo-project/commit/641cb18fec58de43a3468f314e5f8808c560e6d9",
        "target": {
            "file": "zoo-project/zoo-kernel/caching.c"
        },
        "signature_type": "Line",
        "deprecated": false,
        "id": "CVE-2024-53982-16b3bb5a",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "89864737734790728354379680494055436233",
                "218627732092884465567893523752486086070",
                "277575344540088620866178398642557310035"
            ],
            "threshold": 0.9
        }
    },
    {
        "source": "https://github.com/zoo-project/zoo-project/commit/641cb18fec58de43a3468f314e5f8808c560e6d9",
        "target": {
            "file": "zoo-project/zoo-kernel/request_parser.c"
        },
        "signature_type": "Line",
        "deprecated": false,
        "id": "CVE-2024-53982-b0627b16",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "89558282617800741961259504017649263246",
                "150105524581857720004626526766097436910",
                "14878500196977113979682217999453194138",
                "158605241648267988128632444666760839685",
                "159959707117060854273977877341535647010",
                "323594446188765198061281885972998593596",
                "250534609835916192808971473605436555433",
                "93500374119167387092755294843810616412",
                "97654620788082124132408014946069436990",
                "7062937340696047204475784922709317065",
                "154494565127777593064887750955246608670",
                "136684648961373302502137439904441750578"
            ],
            "threshold": 0.9
        }
    },
    {
        "source": "https://github.com/zoo-project/zoo-project/commit/641cb18fec58de43a3468f314e5f8808c560e6d9",
        "target": {
            "function": "kvpParseInputs",
            "file": "zoo-project/zoo-kernel/request_parser.c"
        },
        "signature_type": "Function",
        "deprecated": false,
        "id": "CVE-2024-53982-f418b0f4",
        "signature_version": "v1",
        "digest": {
            "function_hash": "222559297315698666955515957101205709585",
            "length": 4552.0
        }
    }
]