CVE-2024-12019
March 14, 2025, 6:15 p.m.
None
No Score
Description
The API used to interact with documents in the application contains a flaw that allows an authenticated attacker to read the contents of files on the underlying operating system. An account with ‘read’ and ‘download’ privileges on at least one existing document in the application is required to exploit the vulnerability. Exploitation of this vulnerability would allow an attacker to read the contents of any file available within the privileges of the system user running the application.
Product(s) Impacted
| Vendor | Product | Versions |
|---|---|---|
| Synopsys |
|
|
Weaknesses
Common security weaknesses mapped to this vulnerability.
CWE-23
Relative Path Traversal
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.
*CPE(s)
Affected systems and software identified for this CVE.
| Type | Vendor | Product | Version | Update | Edition | Language | Software Edition | Target Software | Target Hardware | Other Information |
|---|---|---|---|---|---|---|---|---|---|---|
| a | synopsys | application | / | / | / | / | / | / | / | / |
Tags
Timeline
Published: March 14, 2025, 6:15 p.m.
Last Modified: March 14, 2025, 6:15 p.m.
Last Modified: March 14, 2025, 6:15 p.m.
Status : Received
CVE has been recently published to the CVE List and has been received by the NVD.
More infoSource
disclosure@synopsys.com
*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.