Lucene search

[email protected]CVE-2024-2599

HistoryMar 18, 2024 - 2:15 p.m.

CVE-2024-2599

2024-03-1814:15:13

CWE-434

[email protected]

web.nvd.nist.gov

cve-2024-2599

file upload

restriction evasion

amss++

rce

webshell

infrastructure

vulnerability

9.9 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

6.6 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

JSON

File upload restriction evasion vulnerability in AMSS++ version 4.31. This vulnerability could allow an authenticated user to potentially obtain RCE through webshell, compromising the entire infrastructure.

Affected configurations

Vulners

Node

amssplusamss\+\+Range≤4.31

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "AMSS++",
    "vendor": "Amssplus",
    "versions": [
      {
        "status": "affected",
        "version": "4.31"
      }
    ]
  }
]

References

www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss

9.9 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

6.6 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

JSON

Related for CVE-2024-2599

cvelist1 nvd1