CVE-2024-13210

Katalog CVE

CVSS 7.2 · High EPSS 0,49%

Kerentanan Improper Access Control pada donglight bookstore. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

A vulnerability was found in donglight bookstore电商书城系统说明 1.0. It has been declared as critical. Affected by this vulnerability is the function uploadPicture of the file src/main/java/org/zdd/bookstore/web/controller/admin/AdminBookController. java. The manipulation of the argument pictureFile leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Rincian

Terbit di NVD

9 Januari 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control
CWE-434: Unrestricted Upload of File with Dangerous Type

EPSS (30 hari)

0,49% peluang dieksploitasi; lebih tinggi dari 40,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://vuldb.com/?id.290815 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.469686 advisory pihak ketiga · vdb entry
• https://github.com/donglight/bookstore/issues/10 exploit · issue tracking
• https://github.com/donglight/bookstore/issues/10#issue-2760923048 exploit · issue tracking
• https://vuldb.com/?ctiid.290815 permissions required · vdb entry