CVE-2024-50919

Improper Control of Generation of Code ('Code Injection') (CWE-94)

Published: Nov 18, 2024 / Updated: 1d ago

010
CVSS 9.8EPSS 0.05%Critical
CVE info copied to clipboard

Summary

Jpress versions up to and including v5.1.1 are vulnerable to arbitrary file uploads on Windows platforms. This vulnerability allows for the construction of non-standard file formats such as .jsp, which can lead to arbitrary command execution.

Impact

This vulnerability has a severe impact on affected systems. Attackers can exploit this to upload malicious files, potentially leading to arbitrary command execution. This could result in complete system compromise, including unauthorized access to sensitive data, modification of system files, and potential disruption of services. The vulnerability has high impacts on confidentiality, integrity, and availability of the affected system.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

A patch is not explicitly mentioned in the provided information. However, given that the vulnerability affects Jpress up to v5.1.1, it's likely that versions after v5.1.1, if available, have addressed this issue. Users should check for and upgrade to the latest version of Jpress that fixes this vulnerability.

Mitigation

1. Upgrade Jpress to a version newer than v5.1.1 if available. 2. Implement strict file upload validation and sanitization mechanisms. 3. Use a web application firewall (WAF) to filter out malicious requests. 4. Restrict file upload permissions and execute uploaded files with minimal privileges. 5. Regularly monitor and audit file uploads and system activities. 6. If possible, avoid running Jpress on Windows platforms until a patch is available. 7. Implement network segmentation to limit the potential impact of a successful exploit.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Timeline

CVE Assignment

NVD published the first details for CVE-2024-50919

Nov 18, 2024 at 8:15 PM
First Article

Feedly found the first article mentioning CVE-2024-50919. See article

Nov 18, 2024 at 8:21 PM / National Vulnerability Database
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Nov 18, 2024 at 8:21 PM
EPSS

EPSS Score was set to: 0.05% (Percentile: 17%)

Nov 19, 2024 at 9:42 AM
CVSS

A CVSS base score of 9.8 has been assigned.

Nov 19, 2024 at 4:40 PM / nvd
Static CVE Timeline Graph

Affected Systems

Jpress/jpress
+null more

Attack Patterns

CAPEC-242: Code Injection
+null more

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:None
User Interaction:None
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI