CVE-2024-25153

Katalog CVE

CVSS 9.8 · Critical EPSS 41,7%

Kerentanan External Control of Assumed-Immutable Web Parameter pada fortra filecatalyst workflow. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

A directory traversal within the ‘ftpservlet’ of the FileCatalyst Workflow Web Portal allows files to be uploaded outside of the intended ‘uploadtemp’ directory with a specially crafted POST request. In situations where a file is successfully uploaded to web portal’s DocumentRoot, specially crafted JSP files could be used to execute code, including web shells.

Rincian

Terbit di NVD

13 Maret 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-472: External Control of Assumed-Immutable Web Parameter
CWE-668: Exposure of Resource to Wrong Sphere

EPSS (30 hari)

41,7% peluang dieksploitasi; lebih tinggi dari 98,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.fortra.com/security/advisory/fi-2024-002 advisory vendor
• https://filecatalyst.software/public/filecatalyst/Workflow/5.1.6.114/fcweb_releasenotes.html release notes
• https://github.com/nettitude/CVE-2024-25153/blob/master/CVE-2024-25153.py