by Kastro
Paper/Archive/CVE-2024-11312

CVE-2024-11312

TRCore DVC — TRCore DVC - Arbitrary File Upload through Path Traversal

EPSS 1%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 72.3.723 × 2014.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to upload arbitrary files to any directory, leading to arbitrary code execution by uploading webshells.

Affected

ProductAffectedFixed inSource
DVC6.0 – 6.3–CNA
dvc6.0 – 6.3–CISA-ADP

Scores by source

twcert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

writeuptwcert.org.tw/tw/cp-132-8248-8dac9-1.htmlwriteuptwcert.org.tw/en/cp-139-8249-65252-2.html