CVE-2024-43033

JPress through 5.1.1 on Windows has an arbitrary file upload vulnerability that could cause arbitrary code execution via ::$DATA to AttachmentControll...

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

JPress through 5.1.1 on Windows has an arbitrary file upload vulnerability that could cause arbitrary code execution via ::$DATA to AttachmentController, such as a .jsp::$DATA file to io.jpress.web.commons.controller.AttachmentController#upload. NOTE: this is unrelated to the attack vector for CVE-2024-32358.

出典: OSV.dev (Open Source Vulnerabilities) NVD OSV

参照URL

advisory github.com
advisory nvd.nist.gov
report github.com
web cwe.mitre.org
web github.com