Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cveVulDBCVE-2024-6730
HistoryJul 14, 2024 - 2:15 a.m.

CVE-2024-6730

2024-07-1402:15:03
CWE-434
VulDB
web.nvd.nist.gov
36
nanjing xingyuantu technology
sparkshop
unrestricted upload

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

6.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CVSS4

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/SC:N/VI:L/SI:N/VA:L/SA:N

AI Score

6.5

Confidence

High

EPSS

0

Percentile

15.9%

JSON

A vulnerability was found in Nanjing Xingyuantu Technology SparkShop up to 1.1.6. It has been rated as critical. This issue affects some unknown processing of the file /api/Common/uploadFile. The manipulation of the argument file leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-271403.

Affected configurations

Vulners
Vulnrichment
Node
nanjing_xingyuantu_technologysparkshopMatch1.1.0
OR
nanjing_xingyuantu_technologysparkshopMatch1.1.1
OR
nanjing_xingyuantu_technologysparkshopMatch1.1.2
OR
nanjing_xingyuantu_technologysparkshopMatch1.1.3
OR
nanjing_xingyuantu_technologysparkshopMatch1.1.4
OR
nanjing_xingyuantu_technologysparkshopMatch1.1.5
OR
nanjing_xingyuantu_technologysparkshopMatch1.1.6
VendorProductVersionCPE
nanjing_xingyuantu_technologysparkshop1.1.0cpe:2.3:a:nanjing_xingyuantu_technology:sparkshop:1.1.0:*:*:*:*:*:*:*
nanjing_xingyuantu_technologysparkshop1.1.1cpe:2.3:a:nanjing_xingyuantu_technology:sparkshop:1.1.1:*:*:*:*:*:*:*
nanjing_xingyuantu_technologysparkshop1.1.2cpe:2.3:a:nanjing_xingyuantu_technology:sparkshop:1.1.2:*:*:*:*:*:*:*
nanjing_xingyuantu_technologysparkshop1.1.3cpe:2.3:a:nanjing_xingyuantu_technology:sparkshop:1.1.3:*:*:*:*:*:*:*
nanjing_xingyuantu_technologysparkshop1.1.4cpe:2.3:a:nanjing_xingyuantu_technology:sparkshop:1.1.4:*:*:*:*:*:*:*
nanjing_xingyuantu_technologysparkshop1.1.5cpe:2.3:a:nanjing_xingyuantu_technology:sparkshop:1.1.5:*:*:*:*:*:*:*
nanjing_xingyuantu_technologysparkshop1.1.6cpe:2.3:a:nanjing_xingyuantu_technology:sparkshop:1.1.6:*:*:*:*:*:*:*

CNA Affected

[
  {
    "vendor": "Nanjing Xingyuantu Technology",
    "product": "SparkShop",
    "versions": [
      {
        "version": "1.1.0",
        "status": "affected"
      },
      {
        "version": "1.1.1",
        "status": "affected"
      },
      {
        "version": "1.1.2",
        "status": "affected"
      },
      {
        "version": "1.1.3",
        "status": "affected"
      },
      {
        "version": "1.1.4",
        "status": "affected"
      },
      {
        "version": "1.1.5",
        "status": "affected"
      },
      {
        "version": "1.1.6",
        "status": "affected"
      }
    ]
  }
]

Related

cvelist 1
nvd 1
vulnrichment 1
cvelist
cvelist
CVE-2024-6730 Nanjing Xingyuantu Technology SparkShop uploadFile unrestricted upload
2024-07-14 01:31:04
nvd
nvd
CVE-2024-6730
2024-07-14 02:15:03
vulnrichment
vulnrichment
CVE-2024-6730 Nanjing Xingyuantu Technology SparkShop uploadFile unrestricted upload
2024-07-14 01:31:04

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

6.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CVSS4

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/SC:N/VI:L/SI:N/VA:L/SA:N

AI Score

6.5

Confidence

High

EPSS

0

Percentile

15.9%

JSON
Related for CVE-2024-6730
cvelist1nvd1vulnrichment1