CVE-2024-25183
Directory Traversal in givanz VvvebJs 1.7.2 via scan.php
Publication date: 2025-12-29
Last updated on: 2025-12-29
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| givanz | vvebjs | 1.7.2 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in givanz VvvebJs 1.7.2 is a Directory Traversal issue via the scan.php file. This means an attacker could manipulate file paths to access directories and files outside the intended scope, potentially exposing sensitive information or system files.
How can this vulnerability impact me? :
This vulnerability could allow an attacker to access unauthorized files on the server, which may lead to information disclosure, compromise of system integrity, or further exploitation of the system.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by sending a crafted POST request to the /scan.php endpoint with the mediaPath parameter containing directory traversal sequences such as multiple '../'. For example, using curl: curl -X POST -d "mediaPath=../../../../../../../../../../../../../etc" http://<target>/scan.php. If the server responds with directory contents (e.g., contents of /etc), the system is vulnerable. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting or disabling access to the /scan.php endpoint, validating and sanitizing the mediaPath parameter to prevent directory traversal sequences, and updating VvvebJs to a version later than 1.7.4 where the vulnerability is fixed. [1]