{"id":"CVE-2024-24042","details":"Directory Traversal vulnerability in Devan-Kerman ARRP v.0.8.1 and before allows a remote attacker to execute arbitrary code via the dumpDirect in RuntimeResourcePackImpl component.","aliases":["GHSA-cg24-jjr5-rxmf"],"modified":"2026-08-12T15:13:00.853090Z","published":"2024-03-19T00:00:00Z","database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24042.json"},"references":[{"type":"WEB","url":"https://gist.github.com/apple502j/193358682885fe1a6708309ce934e4ed"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24042.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24042"},{"type":"FIX","url":"https://github.com/Devan-Kerman/ARRP/commit/7ea80db462c8bf66a0565e84fa49c1f2ecb9287b"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/ueaj-kerman/arrp","events":[{"introduced":"0"},{"fixed":"7ea80db462c8bf66a0565e84fa49c1f2ecb9287b"}],"database_specific":{"source":"REFERENCES"}}],"database_specific":{"vanir_signatures":[{"id":"CVE-2024-24042-2ca3d402","signature_type":"Line","signature_version":"v1","source":"https://github.com/ueaj-kerman/arrp/commit/7ea80db462c8bf66a0565e84fa49c1f2ecb9287b","target":{"file":"src/test/java/test/RRPPreTest.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["156303282403943905558692888444192852503","93687705473999988973560996377988987772","213580746361505209026155417043751835230","290340903102340463538326395524160422532","275971354451233924108173567178944229652","253755492120496642504944600855353880705","177753134633381214876515088079828298959","68767942209307575907066076284291039386","193324512269284827062157164124057265623","114514006178859512638631431474415730111","40625661714427887460982156996514163429","25590748101079017766741202213374083236","207735767762306001334355604933116207642"]}},{"source":"https://github.com/ueaj-kerman/arrp/commit/7ea80db462c8bf66a0565e84fa49c1f2ecb9287b","target":{"file":"src/test/java/test/RRPPreTest.java","function":"main"},"deprecated":false,"digest":{"length":2367,"function_hash":"381664525646903467431763584147565958"},"id":"CVE-2024-24042-34cff03f","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/ueaj-kerman/arrp/commit/7ea80db462c8bf66a0565e84fa49c1f2ecb9287b","target":{"file":"src/main/java/net/devtech/arrp/impl/RuntimeResourcePackImpl.java","function":"write"},"deprecated":false,"digest":{"length":523,"function_hash":"51369072524188417061316166231937360893"},"id":"CVE-2024-24042-44bc9e73"},{"id":"CVE-2024-24042-95bb152b","signature_type":"Line","signature_version":"v1","source":"https://github.com/ueaj-kerman/arrp/commit/7ea80db462c8bf66a0565e84fa49c1f2ecb9287b","target":{"file":"src/main/java/net/devtech/arrp/impl/RuntimeResourcePackImpl.java"},"deprecated":false,"digest":{"line_hashes":["152643010200525897383046500222142670874","106165349731854393744400221664498035586","63175273902996847938714157596462983000","257948540610188372314959888527700021809","246928414254965282716247982302616259380","212289575808754624957006788463471862884","178120654052026446053009711328944810804","142056000303700432568898834471312065223"],"threshold":0.9}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/ueaj-kerman/arrp/commit/7ea80db462c8bf66a0565e84fa49c1f2ecb9287b","target":{"file":"src/main/java/net/devtech/arrp/impl/RuntimeResourcePackImpl.java","function":"dumpDirect"},"deprecated":false,"digest":{"length":973,"function_hash":"67402824737179656251066938906196122193"},"id":"CVE-2024-24042-af045847"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-24042.json","vanir_signatures_modified":"2026-08-12T15:13:00Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:R"}]}