Lucene search

GoogleOSV:CVE-2024-24202

HistoryFeb 08, 2024 - 5:15 a.m.

CVE-2024-24202

2024-02-0805:15:08

Google

osv.dev

arbitrary file upload

zentao

vulnerability

execute arbitrary code

crafted file

control.php

software

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

43.5%

JSON

An arbitrary file upload vulnerability in /upgrade/control.php of ZenTao Community Edition v18.10, ZenTao Biz v8.10, and ZenTao Max v4.10 allows attackers to execute arbitrary code via uploading a crafted .txt file.

CPENameOperatorVersion
zentaopmseqzentaopms_12.4.4_20201030
zentaopmseqzentaopms_11.5.1_20190624
zentaopmseqzentaopms_10.5.stable_20181025
zentaopmseqzentaopms_8.1.3_20160323
zentaopmseqzentaopms_17.8
zentaopmseqzentaopms_18.5
zentaopmseqzentaopms_20.0._20201022
zentaopmseqzentaopms_9.1.1_20170410
zentaopmseqzentaopms_15.6_20211012
zentaopmseqzentaopms_18.0

Name	Operator	Version
zentaopms	eq	zentaopms_12.4.4_20201030
zentaopms	eq	zentaopms_11.5.1_20190624
zentaopms	eq	zentaopms_10.5.stable_20181025
zentaopms	eq	zentaopms_8.1.3_20160323
zentaopms	eq	zentaopms_17.8
zentaopms	eq	zentaopms_18.5
zentaopms	eq	zentaopms_20.0._20201022
zentaopms	eq	zentaopms_9.1.1_20170410
zentaopms	eq	zentaopms_15.6_20211012
zentaopms	eq	zentaopms_18.0

Rows per page:

1-10 of 1971

References

clammy-blizzard-8ef.notion.site/Zentao-PMS-Authorized-Remote-Code-Execution-Vulnerability-1077a870c92848e18fe0c139c4fc2176

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

43.5%

JSON

Related for OSV:CVE-2024-24202