CVE-2024-2565

A vulnerability was found in PandaXGO PandaX up to 20240310. It has been classified as critical. Affected is an unknown function of the file /apps/system/router/upload.go of the component File Extension Handler. The manipulation of the argument file leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257064.

CVSS v3.0 9.8 CRITICAL

9.8^/10

CVSS v3.0 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/PandaXGO/PandaX/issues/5	Issue Tracking
https://github.com/PandaXGO/PandaX/issues/5	Issue Tracking
https://vuldb.com/?ctiid.257064	Permissions Required VDB Entry
https://vuldb.com/?ctiid.257064	Permissions Required VDB Entry
https://vuldb.com/?id.257064	Permissions Required VDB Entry
https://vuldb.com/?id.257064	Permissions Required VDB Entry

Configurations

Configuration 1 (hide)

cpe:2.3:a:pandax:pandax:*:*:*:*:*:*:*:*

History

05 Mar 2025, 14:53

Type	Values Removed	Values Added
CPE		cpe:2.3:a:pandax:pandax::::::::
CWE	~~CWE-434~~
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 9.8
References	~~() https://vuldb.com/?id.257064 -~~	() https://vuldb.com/?id.257064 - Permissions Required, VDB Entry
References	~~() https://github.com/PandaXGO/PandaX/issues/5 -~~	() https://github.com/PandaXGO/PandaX/issues/5 - Issue Tracking
References	~~() https://vuldb.com/?ctiid.257064 -~~	() https://vuldb.com/?ctiid.257064 - Permissions Required, VDB Entry
First Time		Pandax pandax Pandax

17 Mar 2024, 15:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-03-17 15:15

Updated : 2025-03-05 14:53

NVD link : CVE-2024-2565

Mitre link : CVE-2024-2565

JSON object : View

Products Affected

pandax

pandax

CWE

No CWE.

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://github.com/PandaXGO/PandaX/issues/5", "name": "https://github.com/PandaXGO/PandaX/issues/5", "tags": ["Issue Tracking"], "refsource": ""}, {"url": "https://github.com/PandaXGO/PandaX/issues/5", "name": "https://github.com/PandaXGO/PandaX/issues/5", "tags": ["Issue Tracking"], "refsource": ""}, {"url": "https://vuldb.com/?ctiid.257064", "name": "VDB-257064 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["Permissions Required", "VDB Entry"], "refsource": ""}, {"url": "https://vuldb.com/?ctiid.257064", "name": "VDB-257064 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["Permissions Required", "VDB Entry"], "refsource": ""}, {"url": "https://vuldb.com/?id.257064", "name": "VDB-257064 | PandaXGO PandaX File Extension upload.go unrestricted upload", "tags": ["Permissions Required", "VDB Entry"], "refsource": ""}, {"url": "https://vuldb.com/?id.257064", "name": "VDB-257064 | PandaXGO PandaX File Extension upload.go unrestricted upload", "tags": ["Permissions Required", "VDB Entry"], "refsource": ""}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "A vulnerability was found in PandaXGO PandaX up to 20240310. It has been classified as critical. Affected is an unknown function of the file /apps/system/router/upload.go of the component File Extension Handler. The manipulation of the argument file leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257064."}]}, "problemtype": {"problemtype_data": [{"description": []}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2024-2565", "ASSIGNER": "cna@vuldb.com"}}, "impact": {"baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}}, "publishedDate": "2024-03-17T15:15Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:pandax:pandax:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "2024-03-10"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2025-03-05T14:53Z"}