Zentao v18.0 to v18.10 vulnerable to remote code execution
CVE-2024-24216

9.8CRITICAL

Key Information:

Vendor

Zentao

Status
Zentao
Vendor
CVE Published:
8 February 2024

What is CVE-2024-24216?

The vulnerability identified in Zentao versions 18.0 to 18.10 allows attackers to exploit the checkConnection method located in /app/zentao/module/repo/model.php. Through this remote code execution vulnerability, an unauthorized user may execute arbitrary code on the affected system, posing significant security risks. Organizations using Zentao should take immediate action to patch their installations and mitigate potential threats.

References

https://github.com/easysoft/zentaopms/issues/133
https://github.com/l3s10n/ZenTaoPMS_RCE

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.