CVE-2024-24350

Опубликовано: 08 фев. 2024

Источник: nvd

CVSS3: 8.8

EPSS Низкий

Описание

File Upload vulnerability in Software Publico e-Sic Livre v.2.0 and before allows a remote attacker to execute arbitrary code via the extension filtering component.

Ссылки

https://gist.github.com/viniciuspinheiros/4e53b297fd6466cf12d01867ee1c9c33
Third Party Advisory
https://medium.com/%40viniciuspinheiros/e-sic-livre-2-0-authenticated-file-upload-leads-to-remote-code-execution-rce-5937c9537258
Exploit
https://gist.github.com/viniciuspinheiros/4e53b297fd6466cf12d01867ee1c9c33
Third Party Advisory
https://medium.com/%40viniciuspinheiros/e-sic-livre-2-0-authenticated-file-upload-leads-to-remote-code-execution-rce-5937c9537258
Exploit

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:softwarepublico:e-sic_livre:*:*:*:*:*:*:*:*

Версия до 2.0 (включая)

EPSS

Процентиль: 83%

0.01871

Низкий

8.8 High

CVSS3

Дефекты

CWE-434

Связанные уязвимости

GHSA-p9xw-3r92-842f