Paper/Archive/CVE-2024-11984

CVE-2024-11984

SUNNET Technology Co., Ltd. Corporate Training Management System — SUNNET Corporate Training Management System - Unrestricted Upload of File with Dangerous Type

EPSS 0.8%CVSS 9.4

critical.is priorityof 100

CVSS 9.4 (CNA)9.4 / 10 × 3028.2 Not in CISA KEV+300.0 EPSS percentile 55.4.554 × 2011.1 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A unrestricted upload of file with dangerous type vulnerability in epaper draft function in Corporate Training Management System before 10.13 allows remote authenticated users to bypass file upload restrictions and perform arbitrary system commands with SYSTEM privilege via a crafted ZIP file.

Affected

ProductAffectedFixed inSource

Corporate Training Management System< 10.1310.13CNA

Scores by source

ZUSO ART (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CISA ADP8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

writeupzuso.ai/advisory/za-2024-10