Threat database

CVE-2024-58387 is a high-severity vulnerability in Inspur Haiyue HCM Cloud that allows unauthenticated remote attackers to read arbitrary files on the server via a path traversal flaw in the /api/model_report/file/download endpoint. Attackers can manipulate the index and ext parameters to traverse the filesystem and access sensitive files such as /etc/passwd and application database files. This vulnerability was publicly observed in exploitation attempts by the Shadowserver Foundation on November 4, 2024.