CVE-2024-37224: Directory Traversal in SP Project & Document Manager

The Directory Traversal vulnerability allows an attacker to bypass intended access restrictions and retrieve files from the server's file system. Successful exploitation could lead to the exposure of sensitive data such as configuration files, database credentials, or even source code. An attacker could leverage this to gain a deeper understanding of the application's architecture and identify further vulnerabilities. While the immediate impact is information disclosure, it could be a stepping stone for more severe attacks, such as code execution if sensitive files contain credentials or scripts.

1. Reserved2024-06-04
2. Published2024-07-09
3. Modified2024-08-02
4. EPSS updated2026-04-02

The primary mitigation is to upgrade SP Project & Document Manager to version 4.71.1 or later, which contains the fix for this vulnerability. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to restrict access to sensitive files and directories. Specifically, block requests containing path traversal sequences like ../. Regularly review access logs for suspicious requests attempting to access files outside of the intended directory structure. Implement strict file permissions on the server to limit the impact of a successful attack.