How severe is CVE-2024-45312?

This vulnerability has a severity rating of MEDIUM with a CVSS score of 5.3 out of 10.

What type of vulnerability is CVE-2024-45312?

This is classified as CWE-22, which is a common weakness in software security.

CVE-2024-45312 - MEDIUM Severity | CVSS 5.3

Vulnerability Description

Overleaf is a web-based collaborative LaTeX editor. Overleaf Community Edition and Server Pro prior to version 5.0.7 (or 4.2.7 for the 4.x series) contain a vulnerability that allows an arbitrary language parameter in client spelling requests to be passed to the `aspell` executable running on the server. This causes `aspell` to attempt to load a dictionary file with an arbitrary filename. File access is limited to the scope of the overleaf server. The problem is patched in versions 5.0.7 and 4.2.7. Previous versions can be upgraded using the Overleaf toolkit `bin/upgrade` command. Users unable to upgrade may block POST requests to `/spelling/check` via a Web Application Firewall will prevent access to the vulnerable spell check feature. However, upgrading is advised.

Related Vulnerabilities

CVE-2012-3337

MEDIUM

CVSS:5.3(Medium)

IBM InfoSphere Guardium 8.0, 8.01, and 8.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" se...

CWE-222012

CVE-2013-2565

MEDIUM

CVSS:5.3(Medium)

A vulnerability in Mambo CMS v4.6.5 where the scripts thumbs.php, editorFrame.php, editor.php, images.php, manager.php discloses the root path of the webserver.

CWE-222013

CVE-2014-125068

MEDIUM

CVSS:5.3(Medium)

A vulnerability was found in saxman maps-js-icoads and classified as critical. This issue affects some unknown processing of the file http-server.js. The manipulation leads to path traversal. The patc...

CWE-222014

CVE-2014-3972

MEDIUM

CVSS:5.3(Medium)

Directory traversal vulnerability in Apexis APM-J601-WS cameras with firmware before 17.35.2.49 allows remote attackers to read arbitrary files via unspecified vectors.

CWE-222014

CVE-2014-7174

MEDIUM

CVSS:5.3(Medium)

FarLinX X25 Gateway through 2014-09-25 allows directory traversal via the log-handling feature.

CWE-222014

CVE-2014-8676

MEDIUM

CVSS:5.3(Medium)

Directory traversal vulnerability in the file_get_contents function in SOPlanning 1.32 and earlier allows remote attackers to determine the existence of arbitrary files via a .. (dot dot) in a URL pat...

CWE-222014