CVE-2024-8706

JFinalCMS com.cms.util.TemplateUtils update path traversal

CVSS 5.3 MEDIUMEPSS 0.7%CWE-22

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 5.3EPSS 0.7%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

11 Sep 2024Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

A vulnerability was found in JFinalCMS up to 20240903. It has been classified as problematic. This affects the function update of the file /admin/template/update of the component com.cms.util.TemplateUtils. The manipulation of the argument fileName leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Affected products

n/a · JFinalCMS

References

https://gitee.com/heyewei/JFinalcms/issues/IAOSJG https://github.com/xingjiuW/cve/blob/main/wh.md https://vuldb.com/?ctiid.277215 https://vuldb.com/?id.277215 https://vuldb.com/?submit.402346