Lucene search

[email protected]CVE-2024-24202

HistoryFeb 08, 2024 - 5:15 a.m.

CVE-2024-24202

2024-02-0805:15:08

CWE-434

[email protected]

web.nvd.nist.gov

cve-2024-24202

arbitrary file upload

zentao community edition

zentao biz

zentao max

security vulnerability

code execution

nvd

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

43.5%

JSON

An arbitrary file upload vulnerability in /upgrade/control.php of ZenTao Community Edition v18.10, ZenTao Biz v8.10, and ZenTao Max v4.10 allows attackers to execute arbitrary code via uploading a crafted .txt file.

Affected configurations

NVD

Node

easycorpzentaoMatch18.10community

easycorpzentao_bizMatch8.10

easycorpzentao_maxMatch4.10

CPENameOperatorVersion
easycorp:zentaoeasycorp zentaoeq18.10
easycorp:zentao_bizeasycorp zentao bizeq8.10
easycorp:zentao_maxeasycorp zentao maxeq4.10

CPE	Name	Operator	Version
easycorp:zentao	easycorp zentao	eq	18.10
easycorp:zentao_biz	easycorp zentao biz	eq	8.10
easycorp:zentao_max	easycorp zentao max	eq	4.10

References

clammy-blizzard-8ef.notion.site/Zentao-PMS-Authorized-Remote-Code-Execution-Vulnerability-1077a870c92848e18fe0c139c4fc2176

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

43.5%

JSON

Related for CVE-2024-24202

cvelist1 nvd1 prion1 osv1