CVE-2024-11481

Severity: high (CVSS 8.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-11-29 · updated 2026-06-17
Weakness: CWE-22

Description

A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API. This leads to improper handling of path traversal, insecure forwarding to an AJP backend without adequate validation, and lack of authentication for accessing internal API endpoints.

Affected products

Trellix Enterprise Security Manager (ESM): 11.6.10

References

https://thrive.trellix.com/s/article/000014058

Get alerted when CVE-2024-11481 or the next vulnerability affects your stack