CVE-2024-58396: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in YouDataSum CPAS Audit Management System

CVE-2024-58396 is a path traversal vulnerability in YouDataSum CPAS Audit Management System version 4. The flaw allows unauthenticated attackers to read arbitrary files by exploiting insufficient validation of the fileId parameter in GET requests to the /cpasm4/plugInManController/downPlugs endpoint. Attackers can include '../' sequences in the fileId parameter to traverse directories and access sensitive system files. The vulnerability was first observed exploited in the wild by the Shadowserver Foundation on 2025-01-13. The CVSS 4.0 score is 8.7, indicating a high severity due to network attack vector, no required privileges or user interaction, and high impact on confidentiality.

Successful exploitation allows unauthenticated remote attackers to read arbitrary files on the affected system, potentially exposing sensitive information such as system configuration and user data. This can lead to information disclosure and further attacks based on the data obtained. There is no indication of privilege escalation or code execution from the provided data.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable endpoint and monitor for suspicious requests attempting directory traversal patterns in the fileId parameter.