CVE-2022-24248

CVE-2022-24248 is a medium-severity vulnerability in Ritecms with a CVSS 3.x base score of 6.5. Its EPSS exploit-prediction score of 21% places it in the 97th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-22.

Key facts

Description

RiteCMS version 3.1.0 and below suffers from an arbitrary file deletion via path traversal vulnerability in Admin Panel. Exploiting the vulnerability allows an authenticated attacker to delete any file in the web root (along with any other file on the server that the PHP process user has the proper permissions to delete). Furthermore, an attacker might leverage the capability of arbitrary file deletion to circumvent certain web server security mechanisms such as deleting .htaccess file that would deactivate those security constraints.

Frequently asked questions

What is CVE-2022-24248?
RiteCMS version 3.1.0 and below suffers from an arbitrary file deletion via path traversal vulnerability in Admin Panel. Exploiting the vulnerability allows an authenticated attacker to delete any file in the web root (along with any other file on the server that the PHP process user has the proper permissions to delete). Furthermore, an attacker might leverage the capability of arbitrary file deletion to circumvent certain web server security mechanisms such as deleting .htaccess file that would deactivate those security constraints.
How severe is CVE-2022-24248?
CVE-2022-24248 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability high.
Is CVE-2022-24248 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 21% (97th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2022-24248?
CVE-2022-24248 affects Ritecms. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2022-24248?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2022-24248 published?
CVE-2022-24248 was published on 2022-04-12 and last updated on 2026-06-17.

References

Affected products (1)

More vulnerabilities in Ritecms

All CVEs affecting Ritecms →

Other CWE-22 (Path Traversal) vulnerabilities

Browse all CWE-22 (Path Traversal) vulnerabilities →