CVE-2024-2053: Artica Proxy Unauthenticated LFI Protection Bypass Vulnerability
Artica Tech · Artica Proxy
Affected: Artica Tech Artica Proxy · Exploitation: check available, not yet exploited
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 98% of scored CVEs
DescriptionCVE.org
The Artica Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the "www-data" user. This issue was demonstrated on version 4.50 of the The Artica-Proxy administrative web application attempts to prevent local file inclusion. These protections can be bypassed and arbitrary file requests supplied by unauthenticated users will be returned according to the privileges of the "www-data" user.
Affected products1
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- Artica Tech · Artica Proxy4.50; 4.40
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Check available, not yet exploited. A public nuclei template can confirm it on a system you are authorised to test.
- CISA KEV
- Not listed
- Public check
- Artica Proxy - Unauthenticated LFI · nuclei template in projectdiscovery/nuclei-templates
- Vendor
- Artica Tech
- Published
- March 2024
CoverageNo articles yet
No CyberSIXT article names CVE-2024-2053 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.