CVE-2024-43033

Katalog CVE

CVSS 8.8 · High EPSS 0,98%

Kerentanan Improper Handling of Windows ::DATA Alternate Data Stream pada jpress. Skor CVSS 3.1 8.8 (High) menurut CISA ADP.

Deskripsi (NVD)

JPress through 5.1.1 on Windows has an arbitrary file upload vulnerability that could cause arbitrary code execution via ::$DATA to AttachmentController, such as a .jsp::$DATA file to io.jpress.web.commons.controller.AttachmentController#upload. NOTE: this is unrelated to the attack vector for CVE-2024-32358.

Rincian

Terbit di NVD

22 Agustus 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-69: Improper Handling of Windows ::DATA Alternate Data Stream

EPSS (30 hari)

0,98% peluang dieksploitasi; lebih tinggi dari 61,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/JPressProjects/jpress/issues/188 exploit · issue tracking · advisory vendor
• https://github.com/lazy-forever/CVE-Reference/tree/main/2024/43033 exploit · advisory pihak ketiga
• https://cwe.mitre.org/data/definitions/69.html not applicable