CVE-2024-44807

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-10-11 · updated 2026-07-05
Weakness: CWE-552

Description

A directory listing issue in the baserCMS plugin in D-ZERO CO., LTD. BurgerEditor and BurgerEditor Limited Edition before 2.25.1 allows remote attackers to obtain sensitive information by exposing a list of the uploaded files.

Affected products

D-Zero Burgereditor: before 2.25.1 — fixed in 2.25.1
D-Zero Burgereditor Limited Edition: before 2.25.1 — fixed in 2.25.1

How to fix

Upgrade to a fixed version: D-Zero Burgereditor 2.25.1; D-Zero Burgereditor Limited Edition 2.25.1. Check the vendor advisory for mitigations.

References

https://burger.d-zero.co.jp/blogs/archives/2
https://jvn.jp/en/jp/JVN54676967/
https://jvn.jp/jp/JVN54676967/
https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000109.html

Get alerted when CVE-2024-44807 or the next vulnerability affects your stack