Unrestricted Upload Vulnerability in kalvinGit kvf-admin by Kalvin Software
CVE-2024-9280

9.8CRITICAL

Key Information:

Vendor

Kvf-admin Project

Status
Kvf-admin
Vendor
CVE Published:
27 September 2024

What is CVE-2024-9280?

A vulnerability exists in kalvinGit kvf-admin that allows for an unrestricted file upload through the fileUpload function found in FileUploadKit.java. This issue arises from improper handling of the file argument, which can lead malicious actors to upload unauthorized files. The vulnerability can be exploited remotely, heightening the risk of potential attacks. As kalvinGit utilizes a continuous delivery model with rolling releases, details regarding affected and updated versions are not consistently available, emphasizing the need for users to assess their implementations immediately.

References

https://vuldb.com/?id.278662
https://vuldb.com/?ctiid.278662
https://vuldb.com/?submit.410994

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.