CVE-2024-24024

2024-02-0800:00:00

mitre

www.cve.org

arbitrary file download

novel-plus

filecontroller

cve-2024-24024

AI Score

9.6

Confidence

High

EPSS

0.001

Percentile

39.1%

JSON

An arbitrary File download vulnerability exists in Novel-Plus v4.3.0-RC1 and prior at com.java2nb.common.controller.FileController: fileDownload(). An attacker can pass in specially crafted filePath and fieName parameters to perform arbitrary File download.