8.8

CVE-2024-43033

Exploit
JPress through 5.1.1 on Windows has an arbitrary file upload vulnerability that could cause arbitrary code execution via ::$DATA to AttachmentController, such as a .jsp::$DATA file to io.jpress.web.commons.controller.AttachmentController#upload. NOTE: this is unrelated to the attack vector for CVE-2024-32358.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Jpress ≫ Jpress Version <= 5.1.1
   Microsoft ≫ Windows Version-
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.98% 0.576
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
134c704f-9b21-4f2e-91b3-4a467353bcc0 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-69 Improper Handling of Windows ::DATA Alternate Data Stream

The product does not properly prevent access to, or detect usage of, alternate data streams (ADS).

https://cwe.mitre.org/data/definitions/69.html
Not Applicable
https://github.com/JPressProjects/jpress/issues/188
Vendor Advisory
Exploit
Issue Tracking
https://github.com/lazy-forever/CVE-Reference/tree/main/2024/43033
Third Party Advisory
Exploit