cvelistv5 - cve-2024-22050

CVE-2024-22050 (GCVE-0-2024-22050)

Vulnerability from cvelistv5 – Published: 2024-01-04 20:24 – Updated: 2025-11-29 01:20

Title

Iodine Static File Server Path Traversal Vulnerability

Summary

Path traversal in the static file service in Iodine less than 0.7.33 allows an unauthenticated, remote attacker to read files outside the public folder via malicious URLs.

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

VulnCheck

References

URL

Tags

	https://github.com/boazsegev/iodine/security/advi…	vendor-advisory
	https://github.com/boazsegev/iodine/commit/555823…	patch
	https://github.com/advisories/GHSA-85rf-xh54-whp3	third-party-advisory
	https://vulncheck.com/advisories/vc-advisory-GHSA…	third-party-advisory

Impacted products

	Vendor	Product	Version
			Affected: 0 , < 0.7.33 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T22:35:34.791Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://github.com/boazsegev/iodine/security/advisories/GHSA-85rf-xh54-whp3"
          },
          {
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/boazsegev/iodine/commit/5558233fb7defda706b4f9c87c17759705949889"
          },
          {
            "tags": [
              "third-party-advisory",
              "x_transferred"
            ],
            "url": "https://github.com/advisories/GHSA-85rf-xh54-whp3"
          },
          {
            "tags": [
              "third-party-advisory",
              "x_transferred"
            ],
            "url": "https://vulncheck.com/advisories/vc-advisory-GHSA-85rf-xh54-whp3"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-22050",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-16T18:36:35.376436Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-16T18:37:02.336Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://rubygems.org",
          "defaultStatus": "unaffected",
          "packageName": "iodine",
          "versions": [
            {
              "lessThan": "0.7.33",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:boazsegev:iodine:*:*:*:*:*:ruby:*:*",
                  "versionEndExcluding": "0.7.33",
                  "versionStartIncluding": "0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003ePath traversal in the static file service in Iodine less than 0.7.33 allows an unauthenticated, remote attacker to read files outside the public folder via malicious URLs.\u003c/p\u003e"
            }
          ],
          "value": "Path traversal in the static file service in Iodine less than 0.7.33 allows an unauthenticated, remote attacker to read files outside the public folder via malicious URLs."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-29T01:20:07.474Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/boazsegev/iodine/security/advisories/GHSA-85rf-xh54-whp3"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/boazsegev/iodine/commit/5558233fb7defda706b4f9c87c17759705949889"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://github.com/advisories/GHSA-85rf-xh54-whp3"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vulncheck.com/advisories/vc-advisory-GHSA-85rf-xh54-whp3"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Iodine Static File Server Path Traversal Vulnerability",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2024-22050",
    "datePublished": "2024-01-04T20:24:58.500Z",
    "dateReserved": "2024-01-04T18:44:53.108Z",
    "dateUpdated": "2025-11-29T01:20:07.474Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:boazsegev:iodine:*:*:*:*:*:ruby:*:*\", \"versionEndIncluding\": \"0.7.33\", \"matchCriteriaId\": \"259C2480-6121-490C-8B3A-911E14C61AC7\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Path traversal in the static file service in Iodine less than 0.7.33 allows an unauthenticated, remote attacker to read files outside the public folder via malicious URLs.\\n\\n\"}, {\"lang\": \"es\", \"value\": \"Path traversal en el servicio de archivos est\\u00e1ticos en Iodine inferior a 0.7.33 permite a un atacante remoto no autenticado leer archivos fuera de la carpeta p\\u00fablica a trav\\u00e9s de URL maliciosas.\"}]",
      "id": "CVE-2024-22050",
      "lastModified": "2024-11-21T08:55:27.833",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 3.6}]}",
      "published": "2024-01-04T21:15:10.100",
      "references": "[{\"url\": \"https://github.com/advisories/GHSA-85rf-xh54-whp3\", \"source\": \"disclosure@vulncheck.com\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/boazsegev/iodine/commit/5558233fb7defda706b4f9c87c17759705949889\", \"source\": \"disclosure@vulncheck.com\", \"tags\": [\"Patch\"]}, {\"url\": \"https://github.com/boazsegev/iodine/security/advisories/GHSA-85rf-xh54-whp3\", \"source\": \"disclosure@vulncheck.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://vulncheck.com/advisories/vc-advisory-GHSA-85rf-xh54-whp3\", \"source\": \"disclosure@vulncheck.com\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/advisories/GHSA-85rf-xh54-whp3\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/boazsegev/iodine/commit/5558233fb7defda706b4f9c87c17759705949889\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://github.com/boazsegev/iodine/security/advisories/GHSA-85rf-xh54-whp3\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://vulncheck.com/advisories/vc-advisory-GHSA-85rf-xh54-whp3\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}]",
      "sourceIdentifier": "disclosure@vulncheck.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"disclosure@vulncheck.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-22\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-22\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-22050\",\"sourceIdentifier\":\"disclosure@vulncheck.com\",\"published\":\"2024-01-04T21:15:10.100\",\"lastModified\":\"2025-11-29T02:15:50.880\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Path traversal in the static file service in Iodine less than 0.7.33 allows an unauthenticated, remote attacker to read files outside the public folder via malicious URLs.\"},{\"lang\":\"es\",\"value\":\"Path traversal en el servicio de archivos est\u00e1ticos en Iodine inferior a 0.7.33 permite a un atacante remoto no autenticado leer archivos fuera de la carpeta p\u00fablica a trav\u00e9s de URL maliciosas.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"disclosure@vulncheck.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:boazsegev:iodine:*:*:*:*:*:ruby:*:*\",\"versionEndIncluding\":\"0.7.33\",\"matchCriteriaId\":\"259C2480-6121-490C-8B3A-911E14C61AC7\"}]}]}],\"references\":[{\"url\":\"https://github.com/advisories/GHSA-85rf-xh54-whp3\",\"source\":\"disclosure@vulncheck.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/boazsegev/iodine/commit/5558233fb7defda706b4f9c87c17759705949889\",\"source\":\"disclosure@vulncheck.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/boazsegev/iodine/security/advisories/GHSA-85rf-xh54-whp3\",\"source\":\"disclosure@vulncheck.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://vulncheck.com/advisories/vc-advisory-GHSA-85rf-xh54-whp3\",\"source\":\"disclosure@vulncheck.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/advisories/GHSA-85rf-xh54-whp3\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/boazsegev/iodine/commit/5558233fb7defda706b4f9c87c17759705949889\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/boazsegev/iodine/security/advisories/GHSA-85rf-xh54-whp3\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://vulncheck.com/advisories/vc-advisory-GHSA-85rf-xh54-whp3\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/boazsegev/iodine/security/advisories/GHSA-85rf-xh54-whp3\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}, {\"url\": \"https://github.com/boazsegev/iodine/commit/5558233fb7defda706b4f9c87c17759705949889\", \"tags\": [\"patch\", \"x_transferred\"]}, {\"url\": \"https://github.com/advisories/GHSA-85rf-xh54-whp3\", \"tags\": [\"third-party-advisory\", \"x_transferred\"]}, {\"url\": \"https://vulncheck.com/advisories/vc-advisory-GHSA-85rf-xh54-whp3\", \"tags\": [\"third-party-advisory\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-01T22:35:34.791Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-22050\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-06-16T18:36:35.376436Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-06-16T18:36:57.761Z\"}}], \"cna\": {\"title\": \"Iodine Static File Server Path Traversal Vulnerability\", \"source\": {\"discovery\": \"INTERNAL\"}, \"affected\": [{\"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"0.7.33\", \"versionType\": \"semver\"}], \"packageName\": \"iodine\", \"collectionURL\": \"https://rubygems.org\", \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://github.com/boazsegev/iodine/security/advisories/GHSA-85rf-xh54-whp3\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://github.com/boazsegev/iodine/commit/5558233fb7defda706b4f9c87c17759705949889\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/advisories/GHSA-85rf-xh54-whp3\", \"tags\": [\"third-party-advisory\"]}, {\"url\": \"https://vulncheck.com/advisories/vc-advisory-GHSA-85rf-xh54-whp3\", \"tags\": [\"third-party-advisory\"]}], \"x_generator\": {\"engine\": \"vulncheck\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Path traversal in the static file service in Iodine less than 0.7.33 allows an unauthenticated, remote attacker to read files outside the public folder via malicious URLs.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003ePath traversal in the static file service in Iodine less than 0.7.33 allows an unauthenticated, remote attacker to read files outside the public folder via malicious URLs.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-22\", \"description\": \"CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:boazsegev:iodine:*:*:*:*:*:ruby:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"0.7.33\", \"versionStartIncluding\": \"0\"}], \"operator\": \"OR\"}], \"operator\": \"OR\"}], \"providerMetadata\": {\"orgId\": \"83251b91-4cc7-4094-a5c7-464a1b83ea10\", \"shortName\": \"VulnCheck\", \"dateUpdated\": \"2025-11-29T01:20:07.474Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-22050\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-11-29T01:20:07.474Z\", \"dateReserved\": \"2024-01-04T18:44:53.108Z\", \"assignerOrgId\": \"83251b91-4cc7-4094-a5c7-464a1b83ea10\", \"datePublished\": \"2024-01-04T20:24:58.500Z\", \"assignerShortName\": \"VulnCheck\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2024-22050

Vulnerability from fkie_nvd - Published: 2024-01-04 21:15 - Updated: 2025-11-29 02:15

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

Path traversal in the static file service in Iodine less than 0.7.33 allows an unauthenticated, remote attacker to read files outside the public folder via malicious URLs.

References

URL	Tags
disclosure@vulncheck.com	https://github.com/advisories/GHSA-85rf-xh54-whp3	Patch, Third Party Advisory
disclosure@vulncheck.com	https://github.com/boazsegev/iodine/commit/5558233fb7defda706b4f9c87c17759705949889	Patch
disclosure@vulncheck.com	https://github.com/boazsegev/iodine/security/advisories/GHSA-85rf-xh54-whp3	Vendor Advisory
disclosure@vulncheck.com	https://vulncheck.com/advisories/vc-advisory-GHSA-85rf-xh54-whp3	Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/advisories/GHSA-85rf-xh54-whp3	Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/boazsegev/iodine/commit/5558233fb7defda706b4f9c87c17759705949889	Patch
af854a3a-2127-422b-91ae-364da2661108	https://github.com/boazsegev/iodine/security/advisories/GHSA-85rf-xh54-whp3	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://vulncheck.com/advisories/vc-advisory-GHSA-85rf-xh54-whp3	Patch, Third Party Advisory

Impacted products

	Vendor	Product	Version
	boazsegev	iodine	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:boazsegev:iodine:*:*:*:*:*:ruby:*:*",
              "matchCriteriaId": "259C2480-6121-490C-8B3A-911E14C61AC7",
              "versionEndIncluding": "0.7.33",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Path traversal in the static file service in Iodine less than 0.7.33 allows an unauthenticated, remote attacker to read files outside the public folder via malicious URLs."
    },
    {
      "lang": "es",
      "value": "Path traversal en el servicio de archivos est\u00e1ticos en Iodine inferior a 0.7.33 permite a un atacante remoto no autenticado leer archivos fuera de la carpeta p\u00fablica a trav\u00e9s de URL maliciosas."
    }
  ],
  "id": "CVE-2024-22050",
  "lastModified": "2025-11-29T02:15:50.880",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-01-04T21:15:10.100",
  "references": [
    {
      "source": "disclosure@vulncheck.com",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/advisories/GHSA-85rf-xh54-whp3"
    },
    {
      "source": "disclosure@vulncheck.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/boazsegev/iodine/commit/5558233fb7defda706b4f9c87c17759705949889"
    },
    {
      "source": "disclosure@vulncheck.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/boazsegev/iodine/security/advisories/GHSA-85rf-xh54-whp3"
    },
    {
      "source": "disclosure@vulncheck.com",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://vulncheck.com/advisories/vc-advisory-GHSA-85rf-xh54-whp3"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/advisories/GHSA-85rf-xh54-whp3"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/boazsegev/iodine/commit/5558233fb7defda706b4f9c87c17759705949889"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/boazsegev/iodine/security/advisories/GHSA-85rf-xh54-whp3"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://vulncheck.com/advisories/vc-advisory-GHSA-85rf-xh54-whp3"
    }
  ],
  "sourceIdentifier": "disclosure@vulncheck.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "disclosure@vulncheck.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-85RF-XH54-WHP3

Vulnerability from github – Published: 2019-10-07 16:52 – Updated: 2025-11-15 03:10

Summary

Malicious URL drafting attack against iodines static file server may allow path traversal

Details

Impact

A path traversal vulnerability was detected in iodine's static file service. This vulnerability effects any application running iodine's static file server on an effected iodine version.

Malicious URL drafting may cause the static file server to attempt a response containing data from files that shouldn't be normally accessible from the public folder.

Patches

The vulnerability was patched in version 0.7.34. Please upgrade to the latest version.

Workarounds

A possible workaround would be to disable the static file service and it's X-Sendfile support, sending static files using nginx or a source code solution (sending the data dynamically).

However, it would be better to upgrade iodine to the latest version, as it also contains non-security related fixes.

For more information

If you have any questions or comments about this advisory: * Email Boaz Segev

Severity ?

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "iodine"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.7.34"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-22050"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-04-24T20:13:10Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Impact\n\nA path traversal vulnerability was detected in iodine\u0027s static file service. This vulnerability effects any application running iodine\u0027s static file server on an effected iodine version.\n\nMalicious URL drafting may cause the static file server to attempt a response containing data from files that shouldn\u0027t be normally accessible from the public folder.\n\n### Patches\n\nThe vulnerability was patched in version 0.7.34. Please upgrade to the latest version.\n\n### Workarounds\n\nA possible workaround would be to disable the static file service and it\u0027s `X-Sendfile` support, sending static files using nginx or a source code solution (sending the data dynamically).\n\nHowever, it would be better to upgrade iodine to the latest version, as it also contains non-security related fixes.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Email [Boaz Segev](https://github.com/boazsegev)",
  "id": "GHSA-85rf-xh54-whp3",
  "modified": "2025-11-15T03:10:40Z",
  "published": "2019-10-07T16:52:13Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/boazsegev/iodine/security/advisories/GHSA-85rf-xh54-whp3"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22050"
    },
    {
      "type": "WEB",
      "url": "https://github.com/boazsegev/iodine/commit/5558233fb7defda706b4f9c87c17759705949889"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/boazsegev/iodine"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/iodine/CVE-2024-22050.yml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Malicious URL drafting attack against iodines static file server may allow path traversal"
}

GSD-2024-22050

Vulnerability from gsd - Updated: 2024-01-05 06:02

Details

Path traversal in the static file service in Iodine less than 0.7.33 allows an unauthenticated, remote attacker to read files outside the public folder via malicious URLs.

Aliases

CVE-2024-22050

JSON

To clipboard

{
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2024-22050"
      ],
      "details": "Path traversal in the static file service in Iodine less than 0.7.33 allows an unauthenticated, remote attacker to read files outside the public folder via malicious URLs.\n\n",
      "id": "GSD-2024-22050",
      "modified": "2024-01-05T06:02:20.500705Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "disclosure@vulncheck.com",
        "ID": "CVE-2024-22050",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Path traversal in the static file service in Iodine less than 0.7.33 allows an unauthenticated, remote attacker to read files outside the public folder via malicious URLs.\n\n"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-22",
                "lang": "eng",
                "value": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/boazsegev/iodine/security/advisories/GHSA-85rf-xh54-whp3",
            "refsource": "MISC",
            "url": "https://github.com/boazsegev/iodine/security/advisories/GHSA-85rf-xh54-whp3"
          },
          {
            "name": "https://github.com/boazsegev/iodine/commit/5558233fb7defda706b4f9c87c17759705949889",
            "refsource": "MISC",
            "url": "https://github.com/boazsegev/iodine/commit/5558233fb7defda706b4f9c87c17759705949889"
          },
          {
            "name": "https://github.com/advisories/GHSA-85rf-xh54-whp3",
            "refsource": "MISC",
            "url": "https://github.com/advisories/GHSA-85rf-xh54-whp3"
          },
          {
            "name": "https://vulncheck.com/advisories/vc-advisory-GHSA-85rf-xh54-whp3",
            "refsource": "MISC",
            "url": "https://vulncheck.com/advisories/vc-advisory-GHSA-85rf-xh54-whp3"
          }
        ]
      },
      "source": {
        "discovery": "INTERNAL"
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:boazsegev:iodine:*:*:*:*:*:ruby:*:*",
                    "matchCriteriaId": "259C2480-6121-490C-8B3A-911E14C61AC7",
                    "versionEndIncluding": "0.7.33",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "descriptions": [
          {
            "lang": "en",
            "value": "Path traversal in the static file service in Iodine less than 0.7.33 allows an unauthenticated, remote attacker to read files outside the public folder via malicious URLs.\n\n"
          },
          {
            "lang": "es",
            "value": "Path traversal en el servicio de archivos est\u00e1ticos en Iodine inferior a 0.7.33 permite a un atacante remoto no autenticado leer archivos fuera de la carpeta p\u00fablica a trav\u00e9s de URL maliciosas."
          }
        ],
        "id": "CVE-2024-22050",
        "lastModified": "2024-01-10T15:10:36.697",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2024-01-04T21:15:10.100",
        "references": [
          {
            "source": "disclosure@vulncheck.com",
            "tags": [
              "Patch",
              "Third Party Advisory"
            ],
            "url": "https://github.com/advisories/GHSA-85rf-xh54-whp3"
          },
          {
            "source": "disclosure@vulncheck.com",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/boazsegev/iodine/commit/5558233fb7defda706b4f9c87c17759705949889"
          },
          {
            "source": "disclosure@vulncheck.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://github.com/boazsegev/iodine/security/advisories/GHSA-85rf-xh54-whp3"
          },
          {
            "source": "disclosure@vulncheck.com",
            "tags": [
              "Patch",
              "Third Party Advisory"
            ],
            "url": "https://vulncheck.com/advisories/vc-advisory-GHSA-85rf-xh54-whp3"
          }
        ],
        "sourceIdentifier": "disclosure@vulncheck.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-22"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-22"
              }
            ],
            "source": "disclosure@vulncheck.com",
            "type": "Secondary"
          }
        ]
      }
    }
  }
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-22050 (GCVE-0-2024-22050)

FKIE_CVE-2024-22050

GHSA-85RF-XH54-WHP3

Impact

Patches

Workarounds

For more information

GSD-2024-22050

Tags

Sightings

Nomenclature