CVE-2024-33118

2024-05-0600:00:00

mitre

github.com

luckyframeweb v3.5.2

arbitrary read vulnerability

filedownload method

commoncontroller

AI Score

7.4

Confidence

High

SSVC

Exploitation

none

Automatable

yes

Technical Impact

partial

JSON

LuckyFrameWeb v3.5.2 was discovered to contain an arbitrary read vulnerability via the fileDownload method in class com.luckyframe.project.common.CommonController.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:luckyframe:luckyframeweb:3.5.2:*:*:*:*:*:*:*"
    ],
    "vendor": "luckyframe",
    "product": "luckyframeweb",
    "versions": [
      {
        "status": "affected",
        "version": "3.5.2"
      }
    ],
    "defaultStatus": "unknown"
  }
]