CVE-2024-43033

JPress through 5.1.1 on Windows has an arbitrary file upload vulnerability that could cause arbitrary code execution via ::$DATA to AttachmentControll...

Original description

The description as published by the source.

JPress through 5.1.1 on Windows has an arbitrary file upload vulnerability that could cause arbitrary code execution via ::$DATA to AttachmentController, such as a .jsp::$DATA file to io.jpress.web.commons.controller.AttachmentController#upload. NOTE: this is unrelated to the attack vector for CVE-2024-32358.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

References

advisory github.com
advisory nvd.nist.gov
report github.com
web cwe.mitre.org
web github.com