Unrestricted Upload Vulnerability in Stacks Mobile App Builder Affecting Web Servers
CVE-2024-50527

10CRITICAL

Key Information:

Vendor

WordPress
Status
Stacks Mobile App Builder
Vendor
CVE Published:
4 November 2024

What is CVE-2024-50527?

The vulnerability presents an unrestricted upload of dangerous file types in the Stacks Mobile App Builder, enabling an attacker to upload a web shell to a vulnerable web server. This could allow for unauthorized access and manipulation of server resources, resulting in potential data breaches and significant security risks. The vulnerability affects all versions of Stacks Mobile App Builder up to and including 5.2.3, highlighting the importance of immediate remediation to safeguard web applications.

Affected Version(s)

Stacks Mobile App Builder 0 <= 5.2.3

References

https://patchstack.com/database/Wordpress/Plugin/stacks-m...
vdb-entry

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

.