CVE-2024-28269

Published: Apr 30, 2024Modified: Nov 21, 2024

7.2

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.2 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

ReCrystallize Server 5.10.0.0 allows administrators to upload files to the server. The file upload is not restricted, leading to the ability to upload of malicious files. This could result in a Remote Code Execution.

Related CWEs

CWE-434

Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

References (4)

https://sensepost.com/blog/2024/from-discovery-to-disclosure-recrystallize-server-vulnerabilities/

Source: cve@mitre.org

https://www.recrystallize.com/merchant/ReCrystallize-Server-for-Crysta

Source: cve@mitre.org

https://sensepost.com/blog/2024/from-discovery-to-disclosure-recrystallize-server-vulnerabilities/

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.recrystallize.com/merchant/ReCrystallize-Server-for-Crysta

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.