CVE-2024-8694

Published: Sep 11, 2024Modified: Jun 17, 2026

5.1

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: CNA (Secondary)

Description

A vulnerability, which was classified as problematic, was found in JFinalCMS up to 20240903. This affects the function update of the file /admin/template/update of the component com.cms.controller.admin.TemplateController. The manipulation of the argument fileName leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Affected (1)

Products: Heyewei: Jfinalcms

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Heyewei Jfinalcms	Before 20240903

Related CWEs

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (5)

https://gitee.com/heyewei/JFinalcms/issues/IAOKSQ

Source: cna@vuldb.com

ExploitIssue TrackingVendor Advisory

https://github.com/wave-to/SomeCms/blob/main/JFinalCMS.md

Source: cna@vuldb.com

ExploitThird Party Advisory

https://vuldb.com/?ctiid.277167

Source: cna@vuldb.com

Permissions RequiredVDB Entry

https://vuldb.com/?id.277167

Source: cna@vuldb.com

Third Party AdvisoryVDB Entry

https://vuldb.com/?submit.401858

Source: cna@vuldb.com

Third Party AdvisoryVDB Entry

Timeline

No history available yet.