← Back

CVE-2024-11017

nvd nist
Published: Nov 11, 2024Modified: Nov 18, 2024

JSON object

Loading...
8.8
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 5.9
Source: twcert@cert.org.tw (Secondary)

Description

Webopac from Grand Vice info does not properly validate uploaded file types, allowing remote attackers with regular privileges to upload and execute webshells, which could lead to arbitrary code execution on the server.

Affected (2)

Products: Vice: Webopac
Vice
1 product
Webopac
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Vice
Webopac
From 6 to 6.5.1
Webopac
From 7 to 7.2.3

Related CWEs

CWE-434
Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

References (2)

Source: twcert@cert.org.tw
Third Party Advisory
Source: twcert@cert.org.tw
Third Party Advisory

Timeline

No history available yet.