CVE-2024-9922: Path Traversal in Team+

The primary impact of CVE-2024-9922 is the potential for unauthorized access to sensitive system files. An attacker exploiting this vulnerability could read configuration files, source code, or other data that could reveal credentials, internal network information, or proprietary algorithms. Successful exploitation could lead to further compromise of the system, including data exfiltration or privilege escalation, depending on the files accessed. The lack of authentication required for exploitation significantly broadens the attack surface, making it accessible to a wide range of attackers.

1. Reserved2024-10-14
2. Published2024-10-14
3. Modified2024-10-15
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-9922 is to upgrade Team+ to version 13.5.1 or later, which contains the fix. If immediate upgrading is not possible, consider implementing temporary workarounds such as restricting network access to the Team+ server, implementing strict file system permissions, and closely monitoring file system activity for suspicious access attempts. Web application firewalls (WAFs) configured to detect and block path traversal attempts can also provide an additional layer of defense. After upgrading, verify the fix by attempting to access files outside of the intended directory via the vulnerable parameter; access should be denied.