A vulnerability classified as problematic was found in Guizhou Xiaoma Technology jpress 5.1.2. Affected by this vulnerability is an unknown functionality of the file /commons/attachment/upload of the component Avatar Handler. The manipulation of the argument files leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
References
| Link | Resource |
|---|---|
| https://github.com/dycccccccc/jpress/blob/main/JPRESS%20file%20upload%20leads%20to%20code%20execution.docx | Exploit Third Party Advisory |
| https://vuldb.com/?ctiid.286381 | Permissions Required |
| https://vuldb.com/?id.286381 | Third Party Advisory |
| https://vuldb.com/?submit.453637 | Third Party Advisory |
Configurations
History
03 Dec 2024, 20:04
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-79 |
CWE-434 |
| First Time |
Jpress
Jpress jpress |
|
| CPE | cpe:2.3:a:jpress:jpress:5.1.2:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.4 |
| References | () https://github.com/dycccccccc/jpress/blob/main/JPRESS%20file%20upload%20leads%20to%20code%20execution.docx - Exploit, Third Party Advisory | |
| References | () https://vuldb.com/?id.286381 - Third Party Advisory | |
| References | () https://vuldb.com/?submit.453637 - Third Party Advisory | |
| References | () https://vuldb.com/?ctiid.286381 - Permissions Required |
28 Nov 2024, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-11-28 22:15
Updated : 2024-12-03 20:04
NVD link : CVE-2024-11971
Mitre link : CVE-2024-11971
JSON object : View
Products Affected
jpress
- jpress
CWE
CWE-434
Unrestricted Upload of File with Dangerous Type