Wellchoose Administrative Management System - Arbitrair File Lezen via Path Traversal

The Path Traversal vulnerability in Wellchoose Administrative Management System poses a significant risk to data confidentiality. An attacker exploiting this vulnerability can bypass access controls and retrieve any file accessible to the web server process. This includes configuration files, database backups, source code, and potentially user data. Successful exploitation could lead to complete compromise of the server and its associated data. The lack of authentication required for exploitation broadens the attack surface, making it accessible to a wide range of threat actors.

Organizations utilizing the Wellchoose Administrative Management System in their environments, particularly those with publicly accessible instances or those lacking robust access controls, are at risk. Shared hosting environments where multiple users share the same server are also particularly vulnerable.

1. 2024-10-21Disclosure

   disclosure

1. Gereserveerd2024-10-21
2. Gepubliceerd2024-10-21
3. EPSS bijgewerkt2026-04-02

The primary mitigation for CVE-2024-10200 is to immediately upgrade the Wellchoose Administrative Management System to version 0.0.1 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds such as restricting file access permissions on the server and implementing strict input validation to prevent path manipulation. Web application firewalls (WAFs) configured with rules to block path traversal attempts can also provide a layer of defense. Monitor server logs for suspicious file access patterns.