PatchSiren cyber security CVE debrief

CVE-2024-58396 YouDataSum CVE debrief

CVE-2024-58396 debrief: YouDataSum CPAS Audit Management System V4 path traversal allows unauthenticated file reading via manipulated fileId in GET requests to /cpasm4/plugInManController/downPlugs. This vulnerability enables attackers to access arbitrary files, potentially leading to exposure of sensitive information. Defenders should assess the exposure of their instances and restrict access to prevent unauthorized file reading. The vulnerability was first observed by the Shadowserver Foundation on 2025-01-13.

Vendor: YouDataSum
Product: CPAS Audit Management System
CVSS: HIGH 8.7
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-10-22
Original CVE updated: 2026-10-27
Advisory published: 2026-10-22
Advisory updated: 2026-10-27

Who should care

Defenders responsible for YouDataSum CPAS Audit Management System V4 instances should assess exposure and restrict access to prevent unauthorized file reading. They should also verify the exposure of their instances, monitor for suspicious requests, and prioritize restricting access to the vulnerable endpoint. Additionally, defenders should review compensating controls for exposed systems and track exceptions and retest remediated assets.

Why it matters

CVE-2024-58396 allows unauthenticated attackers to read arbitrary files in YouDataSum CPAS Audit Management System V4. Defenders should verify exposure, restrict access, and monitor for suspicious requests.

Potential unauthorized file reading
Possible exposure of sensitive system files
Need for verification of instance exposure
Priority for restricting access to vulnerable endpoint

Technical summary

The YouDataSum CPAS Audit Management System V4 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the fileId parameter in GET requests to /cpasm4/plugInManController/downPlugs. This vulnerability can lead to the exposure of sensitive system files, such as /etc/passwd. The exploitation of this vulnerability was first observed by the Shadowserver Foundation on 2025-01-13. Official sources confirm a path traversal vulnerability in YouDataSum CPAS Audit Management System V4.

Defensive priority

Defenders should prioritize verifying exposure of YouDataSum CPAS Audit Management System V4 instances and restrict access to the /cpasm4/plugInManController/downPlugs endpoint.

Recommended defensive actions

Verify exposure of YouDataSum CPAS Audit Management System V4 instances
Restrict access to the /cpasm4/plugInManController/downPlugs endpoint
Monitor for suspicious GET requests with ../ sequences in fileId
Review compensating controls for exposed systems while remediation is scheduled and verified
Check relevant monitoring, detection, and logs for exposed assets that need extra review
Track exceptions, retest remediated assets, and close the item only after evidence is documented
Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

Evidence from the Shadowserver Foundation indicates exploitation was first observed on 2025-01-13. Official sources confirm a path traversal vulnerability in YouDataSum CPAS Audit Management System V4.

Sources and references

Verified primary and authoritative sources

CVE-2024-58396 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2024-58396

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2024-58396 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2024-58396

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://github.com/eeeeeeeeee-code/POC/blob/main/wpoc/%E5%8C%97%E4%BA%AC%E5%8F%8B%E6%95%B0%E8%81%9A%E7%A7%91%E6%8A%80/CPAS%E5%AE%A1%E8%AE%A1%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F%E5%AD%98%E5%9C%A8%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md

[email protected]
Source reference
Unverified legacy reference

URL: https://github.com/gelusus/wxvl/blob/main/doc/2024-12/%E3%80%8C%E6%BC%8F%E6%B4%9E%E5%A4%8D%E7%8E%B0%E3%80%8D%E5%8F%8B%E6%95%B0%E8%81%9A%20CPAS%E5%AE%A1%E8%AE%A1%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9FV4%20downPlugs%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md

[email protected]
Source reference
Unverified legacy reference

URL: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/cpas-managment-lfi.yaml

[email protected]
Source reference
Unverified legacy reference

URL: https://www.vulncheck.com/advisories/youdatasum-cpas-audit-management-system-v4-path-traversal-via-downplugs-fileid

[email protected]
Source reference
Unverified legacy reference

URL: https://www.youdatasum.com/

[email protected]

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.