CVE-2024-13671: Arbitrary File Access in Music Sheet Viewer

The primary impact of CVE-2024-13671 is the potential for unauthorized access to sensitive files on the web server. An attacker could exploit this vulnerability to read configuration files, database credentials, source code, or any other file accessible by the web server process. Successful exploitation could lead to data breaches, compromise of server-side applications, and potentially, complete server takeover if sensitive credentials are exposed. The lack of authentication required for exploitation significantly broadens the attack surface, making it a high-priority concern.

1. Reserved2025-01-23
2. Published2025-01-30
3. EPSS updated2026-04-02

The recommended mitigation for CVE-2024-13671 is to immediately update the Music Sheet Viewer plugin to a version that addresses the vulnerability. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to block requests targeting the vulnerable readscorefile() function. Restrict file permissions on the server to minimize the potential damage from a successful exploit. Monitor web server access logs for suspicious activity related to file access attempts. After upgrade, verify the fix by attempting to access a restricted file via the vulnerable endpoint and confirming access is denied.