CVE-2024-28441

Опубликовано: 22 мар. 2024

Источник: nvd

CVSS3: 9.8

EPSS Низкий

Описание

File Upload vulnerability in magicflue v.7.0 and before allows a remote attacker to execute arbitrary code via a crafted request to the messageid parameter of the mail/mailupdate.jsp endpoint.

Ссылки

https://github.com/iamHuFei/HVVault/blob/main/webapp/%E9%AD%94%E6%96%B9%E7%BD%91%E8%A1%A8/magicflu-mailupdate-jsp-fileupload.md
Exploit
Third Party Advisory
https://github.com/iamHuFei/HVVault/blob/main/webapp/%E9%AD%94%E6%96%B9%E7%BD%91%E8%A1%A8/magicflu-mailupdate-jsp-fileupload.md
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:magicflue:magicflue:*:*:*:*:*:*:*:*

Версия до 7.0 (включая)

EPSS

Процентиль: 83%

0.0201

Низкий

9.8 Critical

CVSS3

Дефекты

CWE-434

Связанные уязвимости

GHSA-rxj8-fv7g-cp4v