CVE-2024-9280: kvf-admin project kvf-admin

csirt@kutim:~/threat-intel/cve/CVE-2024-9280

CVSS 9.8 · Critical EPSS 0,58%

Kerentanan Unrestricted Upload of File with Dangerous Type pada kvf-admin project kvf-admin. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

A vulnerability has been found in kalvinGit kvf-admin up to f12a94dc1ebb7d1c51ee978a85e4c7ed75c620ff and classified as critical. This vulnerability affects the function fileUpload of the file FileUploadKit.java. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.

Rincian

Terbit di NVD: 27 September 2024
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-434: Unrestricted Upload of File with Dangerous Type
EPSS (30 hari): 0,58% peluang dieksploitasi; lebih tinggi dari 45,9% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
kvf-admin project	kvf-admin	Versi 2022-02-12

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://vuldb.com/?ctiid.278662 permissions required · advisory pihak ketiga · vdb entry
https://vuldb.com/?id.278662 advisory pihak ketiga · vdb entry
https://vuldb.com/?submit.410994 advisory pihak ketiga · vdb entry
https://github.com/Arvin-Shi/111/issues/1 broken link

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.