CVE-2024-21877 — Insecure File Generation Based on User Input in Enphase IQ Gateway version 4.x to 8.x and < 8.2.4225

CVE-2024-21877

Insecure File Generation Based on User Input in Enphase IQ Gateway version 4.x to 8.x and < 8.2.4225 PUBLISHED

Description (CNA)

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability through a url parameter in Enphase IQ Gateway (formerly known as Envoy) allows File Manipulation. The endpoint requires authentication.This issue affects Envoy: from 4.x to 8.0 and < 8.2.4225.

Affected (CNA)

Vendor / product	Versions
Enphase / Envoy	affected 8.0 before 8.2.4225; affected 7.x; affected 6.x; affected 5.x; affected 4.x

CWE

CWE-22

References

https://csirt.divd.nl/CVE-2024-21877
https://csirt.divd.nl/DIVD-2024-00011
https://enphase.com/cybersecurity/advisories/ensa-2024-2

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.