CVE-2024-22050 - Vulnerability Details - OpenCVE

Path traversal in the static file service in Iodine less than 0.7.33 allows an unauthenticated, remote attacker to read files outside the public folder via malicious URLs.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact partial

Vendors	Products
Boazsegev	Iodine

Configuration 1 [-]

cpe:2.3:a:boazsegev:iodine:*:*:*:*:*:ruby:*:*

No data.

References

Link	Providers
https://github.com/advisories/GHSA-85rf-xh54-whp3
https://github.com/boazsegev/iodine/commit/5558233fb7defda706b4f9c87c17759705949889
https://github.com/boazsegev/iodine/security/advisories/GHSA-85rf-xh54-whp3
https://vulncheck.com/advisories/vc-advisory-GHSA-85rf-xh54-whp3

History

Mon, 16 Jun 2025 19:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published: 2024-01-04T20:24:58.500Z

Updated: 2025-06-16T18:37:02.336Z

Reserved: 2024-01-04T18:44:53.108Z

Link: CVE-2024-22050

Vulnrichment

Updated: 2024-08-01T22:35:34.791Z

NVD

Status : Modified

Published: 2024-01-04T21:15:10.100

Modified: 2025-06-16T19:15:30.827

Link: CVE-2024-22050

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-22050", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2024-01-04T18:44:53.108Z", "datePublished": "2024-01-04T20:24:58.500Z", "dateUpdated": "2025-06-16T18:37:02.336Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://rubygems.org", "defaultStatus": "unaffected", "packageName": "iodine", "versions": [{"lessThan": "0.7.33", "status": "affected", "version": "0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Path traversal in the static file service in Iodine less than 0.7.33 allows an unauthenticated, remote attacker to read files outside the public folder via malicious URLs.</p>"}], "value": "Path traversal in the static file service in Iodine less than 0.7.33 allows an unauthenticated, remote attacker to read files outside the public folder via malicious URLs.\n\n"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2024-01-04T20:24:58.500Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://github.com/boazsegev/iodine/security/advisories/GHSA-85rf-xh54-whp3"}, {"tags": ["patch"], "url": "https://github.com/boazsegev/iodine/commit/5558233fb7defda706b4f9c87c17759705949889"}, {"tags": ["third-party-advisory"], "url": "https://github.com/advisories/GHSA-85rf-xh54-whp3"}, {"tags": ["third-party-advisory"], "url": "https://vulncheck.com/advisories/vc-advisory-GHSA-85rf-xh54-whp3"}], "source": {"discovery": "INTERNAL"}, "title": "Iodine Static File Server Path Traversal Vulnerability"}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:35:34.791Z"}, "title": "CVE Program Container", "references": [{"tags": ["vendor-advisory", "x_transferred"], "url": "https://github.com/boazsegev/iodine/security/advisories/GHSA-85rf-xh54-whp3"}, {"tags": ["patch", "x_transferred"], "url": "https://github.com/boazsegev/iodine/commit/5558233fb7defda706b4f9c87c17759705949889"}, {"tags": ["third-party-advisory", "x_transferred"], "url": "https://github.com/advisories/GHSA-85rf-xh54-whp3"}, {"tags": ["third-party-advisory", "x_transferred"], "url": "https://vulncheck.com/advisories/vc-advisory-GHSA-85rf-xh54-whp3"}]}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-06-16T18:36:35.376436Z", "id": "CVE-2024-22050", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-16T18:37:02.336Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/boazsegev/iodine/security/advisories/GHSA-85rf-xh54-whp3", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "https://github.com/boazsegev/iodine/commit/5558233fb7defda706b4f9c87c17759705949889", "tags": ["patch", "x_transferred"]}, {"url": "https://github.com/advisories/GHSA-85rf-xh54-whp3", "tags": ["third-party-advisory", "x_transferred"]}, {"url": "https://vulncheck.com/advisories/vc-advisory-GHSA-85rf-xh54-whp3", "tags": ["third-party-advisory", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:35:34.791Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-22050", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-06-16T18:36:35.376436Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-16T18:36:57.761Z"}}], "cna": {"title": "Iodine Static File Server Path Traversal Vulnerability", "source": {"discovery": "INTERNAL"}, "affected": [{"versions": [{"status": "affected", "version": "0", "lessThan": "0.7.33", "versionType": "semver"}], "packageName": "iodine", "collectionURL": "https://rubygems.org", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/boazsegev/iodine/security/advisories/GHSA-85rf-xh54-whp3", "tags": ["vendor-advisory"]}, {"url": "https://github.com/boazsegev/iodine/commit/5558233fb7defda706b4f9c87c17759705949889", "tags": ["patch"]}, {"url": "https://github.com/advisories/GHSA-85rf-xh54-whp3", "tags": ["third-party-advisory"]}, {"url": "https://vulncheck.com/advisories/vc-advisory-GHSA-85rf-xh54-whp3", "tags": ["third-party-advisory"]}], "descriptions": [{"lang": "en", "value": "Path traversal in the static file service in Iodine less than 0.7.33 allows an unauthenticated, remote attacker to read files outside the public folder via malicious URLs.\n\n", "supportingMedia": [{"type": "text/html", "value": "<p>Path traversal in the static file service in Iodine less than 0.7.33 allows an unauthenticated, remote attacker to read files outside the public folder via malicious URLs.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2024-01-04T20:24:58.500Z"}}}, "cveMetadata": {"cveId": "CVE-2024-22050", "state": "PUBLISHED", "dateUpdated": "2025-06-16T18:37:02.336Z", "dateReserved": "2024-01-04T18:44:53.108Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2024-01-04T20:24:58.500Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:boazsegev:iodine:*:*:*:*:*:ruby:*:*", "matchCriteriaId": "259C2480-6121-490C-8B3A-911E14C61AC7", "versionEndIncluding": "0.7.33", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Path traversal in the static file service in Iodine less than 0.7.33 allows an unauthenticated, remote attacker to read files outside the public folder via malicious URLs.\n\n"}, {"lang": "es", "value": "Path traversal en el servicio de archivos est\u00e1ticos en Iodine inferior a 0.7.33 permite a un atacante remoto no autenticado leer archivos fuera de la carpeta p\u00fablica a trav\u00e9s de URL maliciosas."}], "id": "CVE-2024-22050", "lastModified": "2025-06-16T19:15:30.827", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-01-04T21:15:10.100", "references": [{"source": "disclosure@vulncheck.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/advisories/GHSA-85rf-xh54-whp3"}, {"source": "disclosure@vulncheck.com", "tags": ["Patch"], "url": "https://github.com/boazsegev/iodine/commit/5558233fb7defda706b4f9c87c17759705949889"}, {"source": "disclosure@vulncheck.com", "tags": ["Vendor Advisory"], "url": "https://github.com/boazsegev/iodine/security/advisories/GHSA-85rf-xh54-whp3"}, {"source": "disclosure@vulncheck.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://vulncheck.com/advisories/vc-advisory-GHSA-85rf-xh54-whp3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/advisories/GHSA-85rf-xh54-whp3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/boazsegev/iodine/commit/5558233fb7defda706b4f9c87c17759705949889"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://github.com/boazsegev/iodine/security/advisories/GHSA-85rf-xh54-whp3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://vulncheck.com/advisories/vc-advisory-GHSA-85rf-xh54-whp3"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-22"}], "source": "nvd@nist.gov", "type": "Primary"}]}