by Kastro
Paper/Archive/CVE-2024-11979

CVE-2024-11979

Interinfo DreamMaker — Interinfo DreamMaker - Unrestricted File Upload through Path Traversal

EPSS 0.8%CVSS 9.8
critical.is priorityof 100
41
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 55.9.559 × 2011.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

DreamMaker from Interinfo has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to upload arbitrary files to any directory, leading to arbitrary code execution by uploading webshells.

Affected

ProductAffectedFixed inSource
DreamMaker< 2024/09/262024/09/26CNA
dreammakerall versions–CISA-ADP

Scores by source

twcert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

writeuptwcert.org.tw/tw/cp-132-8271-29871-1.htmlwriteuptwcert.org.tw/en/cp-139-8272-13a13-2.html