Skip to content
OpenAdvisories
High · 7.7 CVE-2024-49381 EUVD-2024-2966GHSA-6h8w-hrfp-pffxGO-2024-3214

Plenti arbitrary file deletion vulnerability

Published Oct 25, 2024 · Updated Oct 25, 2024 · Assigned by GitHub_M

Vendor: plentico Product: plenti Package: github.com/plentico/plenti Ecosystem: Go

Description

Plenti, a static site generator, has an arbitrary file deletion vulnerability in versions prior to 0.7.2. The `/postLocal` endpoint is vulnerable to an arbitrary file write deletion when a plenti user serves their website. This issue may lead to information loss. Version 0.7.2 fixes the vulnerability.

Affected products

VendorProductAffectedFixed
plentico plenti < 0.7.2 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP6 govulncheck-vulndb 0.0.20241030T212825-150000.1.9.1 SUSE-SU-2024:3911-1
SLES 15 SP5 govulncheck-vulndb 0.0.20241030T212825-150000.1.9.1 SUSE-SU-2024:3911-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SUSE Package Hub 12 govulncheck-vulndb 0.0.20241104T154416-5.1 openSUSE-SU-2024:0350-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed govulncheck-vulndb 0.0.20241030T212825-1.1 openSUSE-SU-2024:14447-1
openSUSE Leap 15.6 govulncheck-vulndb 0.0.20241030T212825-150000.1.9.1 SUSE-SU-2024:3911-1
openSUSE Leap 15.5 govulncheck-vulndb 0.0.20241030T212825-150000.1.9.1 SUSE-SU-2024:3911-1

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/plentico/plenti < 0.7.2 0.7.2 GHSA-6h8w-hrfp-pffx

Advisories 3

References