Publiccms V4.0.202302 vulnerable to Any File Upload via publiccms/admin/cmsTemplate/saveMetaData
CVE-2024-42523

7.2HIGH

Key Information:

Vendor

publiccms

Status
Publiccms
Vendor
CVE Published:
23 August 2024

What is CVE-2024-42523?

PublicCMS versions V4.0.202302.e and earlier are impacted by a security weakness that allows an attacker to upload potentially malicious files through the admin interface (publiccms/admin/cmsTemplate/saveMetaData). This could lead to unauthorized file execution or other security breaches if exploited. Ensuring proper security measures and updating to the latest version is critical to mitigate this risk.

References

https://gitee.com/sanluan/PublicCMS/issues/IADVDM
https://gist.github.com/ilikeoyt/3dbbca2679c2551eaaeaea9c...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.