Critical severity · published Oct 7, 2024
CVE-2024-46446
Mecha CMS 3.0.0 is vulnerable to Directory Traversal
9.8
CVSS
1.4%
EPSS
No
On KEV
Description
Mecha CMS 3.0.0 is vulnerable to Directory Traversal. An attacker can construct cookies and URIs that bypass user identity checks. Parameters can then be passed through the POST method, resulting in the Deletion of Arbitrary Files or Website Takeover.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ME
Mecha · Mecha-cms
3.0.0 · source: NVD
MC
Mecha Cms · Mecha-cms
3.0.0 · source: CISA