CVE-2024-29272

CVSS 6.5 MEDIUMEPSS 9.4%CWE-434

Vexday Risk Score

28Low

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS 6.5EPSS 9.4%KEV nãoPoC —Nuclei simMetasploit —Patch —

Lifecycle

22 Mar 2024Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

Arbitrary File Upload vulnerability in VvvebJs before version 1.7.5, allows unauthenticated remote attackers to execute arbitrary code and obtain sensitive information via the sanitizeFileName parameter in save.php.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected products

n/a · n/a

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/givanz/VvvebJs/commit/c6422cfd4d835c2fa6d512645e30015f24538ef0 https://github.com/givanz/VvvebJs/issues/343