Key points
- The flaw is rated CVSS 8.7 High and affects YouDataSum CPAS Audit Management System V4.
- Attackers can exploit the issue via a GET request to a specific controller endpoint.
- Shadowserver Foundation observed exploitation attempts starting on January 13, 2025.
YouDataSum CPAS Audit Management System V4 contains a high-severity security flaw that allows remote attackers to access sensitive files. The vulnerability is tracked as CVE-2024-58396 and carries a CVSS score of 8.7. This issue permits unauthenticated users to bypass security controls and retrieve arbitrary data from the server.
In plain English
The problem lies in how the system handles file download requests. Attackers can send a specific web request to the /cpasm4/plugInManController/downPlugs endpoint. By manipulating the fileId parameter with sequences like ../, they can trick the system into reading files outside the intended directory. This technique is known as path traversal.
The background
Researchers at the Shadowserver Foundation first observed evidence of this exploitation on January 13, 2025. The attackers successfully used this method to retrieve system files such as /etc/passwd. This confirms that the flaw is actively being used in the wild to gather information about targeted systems.
What changes now
Organizations using YouDataSum CPAS Audit Management System V4 must assess their exposure to this risk. Since the vulnerability allows unauthenticated access, any instance exposed to the internet is at immediate risk. Administrators should verify whether their systems are running the affected version and check for any unauthorized file access attempts in their logs.
Who needs to act first
Teams should prioritize systems that are directly accessible from the internet. Check whether your audit management servers are exposed to public networks. If they are, restrict access using network-level controls immediately. Test any configuration changes in a non-production environment first. Back up your current system state before making adjustments. Monitor logs for unusual file download patterns. Reduce exposure by limiting who can reach these endpoints.
What to do and how to stay safe: YouDataSum
- Verify if you are running YouDataSum CPAS Audit Management System V4.
- Check web server logs for requests containing ../ sequences in the fileId parameter.
- Restrict network access to the application from untrusted sources.
- Wait for the vendor to release a patch or updated version.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for this vulnerability?
The CVSS score for CVE-2024-58396 is 8.7, which is rated as High severity.
Which system is affected by this flaw?
YouDataSum CPAS Audit Management System V4 is affected by this path traversal vulnerability.
Has this vulnerability been exploited in the wild?
Yes, the Shadowserver Foundation observed exploitation evidence on January 13, 2025.
