CVE-2024-24000

2024-02-0600:00:00

mitre

www.cve.org

jsherp

arbitrary file upload

cve-2024-24000

upload path control

9.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

39.1%

JSON

jshERP v3.3 is vulnerable to Arbitrary File Upload. The jshERP-boot/systemConfig/upload interface does not check the uploaded file type, and the biz parameter can be spliced into the upload path, resulting in arbitrary file uploads with controllable paths.