Lucene search

MitreCVE-2024-24350

HistoryFeb 08, 2024 - 1:15 a.m.

CVE-2024-24350

2024-02-0801:15:27

CWE-434

mitre

web.nvd.nist.gov

cve-2024-24350

file upload

vulnerability

software publico

e-sic livre

remote code execution

nvd

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.001

Percentile

19.3%

JSON

File Upload vulnerability in Software Publico e-Sic Livre v.2.0 and before allows a remote attacker to execute arbitrary code via the extension filtering component.

Affected configurations

Nvd

Node

softwarepublicoe-sic_livreRange≤2.0

VendorProductVersionCPE
softwarepublicoe-sic_livre*cpe:2.3:a:softwarepublico:e-sic_livre:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
softwarepublico	e-sic_livre	*	cpe:2.3:a:softwarepublico:e-sic_livre::::::::

References

gist.github.com/viniciuspinheiros/4e53b297fd6466cf12d01867ee1c9c33

medium.com/%40viniciuspinheiros/e-sic-livre-2-0-authenticated-file-upload-leads-to-remote-code-execution-rce-5937c9537258

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.001

Percentile

19.3%

JSON

Related for CVE-2024-24350