CVE-2024-53982

ZOO-Project is a C-based WPS (Web Processing Service) implementation. A path traversal vulnerability was discovered in Zoo-Project Echo example. The Echo example available by default in Zoo installs implements file caching, which can be controlled by user-given parameters. No input validation is performed in this parameter, which allows an attacker to fully control the file which is returned in the response. Patch was committed in November 22nd, 2024.

CVSS

No CVSS.

References

Link	Resource
https://github.com/ZOO-Project/ZOO-Project/commit/641cb18fec58de43a3468f314e5f8808c560e6d9
https://github.com/ZOO-Project/ZOO-Project/security/advisories/GHSA-93rv-45r8-h5j4

Configurations

No configuration.

History

15 Apr 2026, 00:35

Type	Values Removed	Values Added
Summary		(es) ZOO-Project es una implementación de WPS (Web Processing Service) basada en C. Se descubrió una vulnerabilidad de path traversal en el ejemplo Echo de Zoo-Project. El ejemplo Echo disponible de forma predeterminada en las instalaciones de Zoo implementa el almacenamiento en caché de archivos, que se puede controlar mediante parámetros proporcionados por el usuario. No se realiza ninguna validación de entrada en este parámetro, lo que permite a un atacante controlar por completo el archivo que se devuelve en la respuesta. El parche se implementó el 22 de noviembre de 2024.

04 Dec 2024, 23:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-12-04 23:15

Updated : 2026-06-17 08:09

NVD link : CVE-2024-53982

Mitre link : CVE-2024-53982

CVE.ORG link : CVE-2024-53982

JSON object : View

Products Affected

No product.

CWE

CWE-434

Unrestricted Upload of File with Dangerous Type

{"id": "CVE-2024-53982", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-53982", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2024-12-05T18:46:24.489100Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "ZOO-Project", "product": "ZOO-Project", "versions": [{"status": "affected", "version": "< 641cb18fec58de43a3468f314e5f8808c560e6d9"}]}]}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "affectedData": [{"cpes": ["cpe:2.3:a:zoo_project:zoo:*:*:*:*:*:*:*:*"], "vendor": "zoo_project", "product": "zoo", "versions": [{"status": "affected", "version": "0", "lessThan": "641cb18fec58de43a3468f314e5f8808c560e6d9", "versionType": "custom"}], "defaultStatus": "unknown"}]}], "published": "2024-12-04T23:15:05.943", "references": [{"url": "https://github.com/ZOO-Project/ZOO-Project/commit/641cb18fec58de43a3468f314e5f8808c560e6d9", "source": "security-advisories@github.com"}, {"url": "https://github.com/ZOO-Project/ZOO-Project/security/advisories/GHSA-93rv-45r8-h5j4", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "ZOO-Project is a C-based WPS (Web Processing Service) implementation. A path traversal vulnerability was discovered in Zoo-Project Echo example. The Echo example available by default in Zoo installs implements file caching, which can be controlled by user-given parameters. No input validation is performed in this parameter, which allows an attacker to fully control the file which is returned in the response. Patch was committed in November 22nd, 2024."}, {"lang": "es", "value": "ZOO-Project es una implementaci\u00f3n de WPS (Web Processing Service) basada en C. Se descubri\u00f3 una vulnerabilidad de path traversal en el ejemplo Echo de Zoo-Project. El ejemplo Echo disponible de forma predeterminada en las instalaciones de Zoo implementa el almacenamiento en cach\u00e9 de archivos, que se puede controlar mediante par\u00e1metros proporcionados por el usuario. No se realiza ninguna validaci\u00f3n de entrada en este par\u00e1metro, lo que permite a un atacante controlar por completo el archivo que se devuelve en la respuesta. El parche se implement\u00f3 el 22 de noviembre de 2024."}], "lastModified": "2026-06-17T08:09:36.753", "sourceIdentifier": "security-advisories@github.com"}