CVE-2024-38824

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Directory traversal vulnerability in recv_file method allows arbitrary files to be written to the master cache directory.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-22

Affected software

VendorProductVersions
VMwareSALT>= 3006.x, < 3006.12; >= 3007.x, < 3007.4

References

Timeline

Published
Jun 13, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-388256.4The salt.auth.pki module does not properly authenticate callers. The "password" field contains a public certificate which is validated againCVE-2024-388265.3Authenticated users can upload specifically crafted files to leak server resources. This behavior can potentially be used to run a denial ofCVE-2024-388274.8The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in authorizatiCVE-2024-388285.3Spring MVC controller methods with an @RequestBody byte[] method parameter are vulnerable to a DoS attack.CVE-2024-388293.7A vulnerability in Spring LDAP allows data exposure for case sensitive comparisons.This issue affects Spring LDAP: from 2.4.0 through 2.4.3,CVE-2024-38835.4The 3D FlipBook plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Bookmark URL field in all versions up to, and inclCVE-2024-388307.8VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with local administrative privileges may triggCVE-2024-388317.8VMware Aria Operations contains a local privilege escalation vulnerability.  A malicious actor with local administrative privileges can inseCVE-2024-388326.4VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to views may be able to iCVE-2024-388335.4VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to email templates might CVE-2024-388344.8VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to cloud provider might bCVE-2024-38847.5A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(Str
CVE-2024-38824: High severity, CVSS 7.5 | Vulnix