CVE-2024-29272

2024-03-2200:00:00

mitre

github.com

arbitrary file upload

vvvebjs

remote attackers

execute arbitrary code

sensitive information

sanitizefilename parameter

AI Score

7.8

Confidence

Low

EPSS

0.001

Percentile

22.6%

SSVC

Exploitation

poc

Automatable

Technical Impact

total

JSON

Arbitrary File Upload vulnerability in VvvebJs before version 1.7.5, allows unauthenticated remote attackers to execute arbitrary code and obtain sensitive information via the sanitizeFileName parameter in save.php.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:givanz:vvvebjs:*:*:*:*:*:*:*:*"
    ],
    "vendor": "givanz",
    "product": "vvvebjs",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "1.7.5",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]