NVIDIA Mellanox OS/ONYX/Skyway/MetroX CGI Path Traversal Vulnerability (CVE-2024-0113)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Description: - CVE ID: CVE-2024-0113 - Description: A vulnerability exists in NVIDIA Mellanox OS, ONYX, Skyway, and MetroX-3 XCC. Attackers can trigger a CGI path traversal in the web support by crafting a malicious URI. Successful exploitation of this vulnerability may lead to privilege escalation and information disclosure. 2. Vulnerability Impact: - Vector: AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Base Score: 7.5 - Severity: High - CWE: CWE-35 - Impact: Privilege Escalation, Information Disclosure 3. Affected Products and Versions: - Mellanox OS: - All versions up to 3.11.4000 - ONYX: - All versions up to 3.11.2200 - Skyway: - All versions up to 3.10.4400 - MetroX-3 XC: - All versions up to 3.10.4400 - MetroX-2: - All versions up to 3.11.4000 4. Security Updates: - Updated Versions: - Mellanox OS: 3.12.1002 - ONYX: 3.10.4504 - Skyway: 8.2.2300 - MetroX-3 XC: 8.1.4500 - MetroX-2: 3.12.1002 5. Notes: - Earlier versions of the products are also affected. If you are using an earlier version, please upgrade to the latest version. 6. Disclaimer: - All information and documentation (including materials) provided by NVIDIA are offered "as is" without any express or implied warranties, including but not limited to warranties of merchantability, fitness for a particular purpose, or non-infringement. NVIDIA is not liable for any use of such information or any infringement of third-party rights. 7. Support Information: - For any questions, please contact NVIDIA Support. This information provides a detailed description of the vulnerability's nature, scope of impact, corresponding security updates, and important notes.

Goal Reached Thanks to every supporter — we hit 100%!

NVIDIA Mellanox OS/ONYX/Skyway/MetroX CGI Path Traversal Vulnerability (CVE-2024-0113)