Unrestricted File Upload Vulnerability in ZeroWdd myblog Software
CVE-2024-13191

9.8CRITICAL

Key Information:

Vendor

ZeroWdd

Status
Myblog
Vendor
CVE Published:
8 January 2025

What is CVE-2024-13191?

A vulnerability affecting ZeroWdd myblog 1.0 allows for unrestricted file uploads through the upload function in the uploadController.java file. Attackers can manipulate file upload parameters to initiate remote attacks, potentially leading to server compromise. The exploit has been publicly disclosed, raising concerns over the potential for unauthorized access and malicious file execution. Users are advised to apply security measures immediately to mitigate risks.

References

https://github.com/ZeroWdd/myblog/issues/3
https://github.com/ZeroWdd/myblog/issues/3#issue-2759839215
https://vuldb.com/?ctiid.290783

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.