GitHub_MVULNRICHMENT:CVE-2024-30248CVE-2024-30248 Piccolo Admin's raw SVG loading may lead to complete data compromise from admin page
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
AI Score
Confidence
High
SSVC
Exploitation
poc
Automatable
no
Technical Impact
total
Piccolo Admin is an admin interface/content management system for Python, built on top of Piccolo. Piccolo’s admin panel allows media files to be uploaded. As a default, SVG is an allowed file type for upload. An attacker can upload an SVG which when loaded can allow arbitrary access to the admin page. This vulnerability was patched in version 1.3.2.
ADP Affected
[
{
"cpes": [
"cpe:2.3:a:piccolo-orm:piccolo_admin:1.2.0:*:*:*:*:*:*:*"
],
"vendor": "piccolo-orm",
"product": "piccolo_admin",
"versions": [
{
"status": "affected",
"version": "1.2.0",
"lessThan": "1.3.2",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
}
]Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
AI Score
Confidence
High
SSVC
Exploitation
poc
Automatable
no
Technical Impact
total