Paper/Archive/CVE-2024-26503

CVE-2024-26503

gunet open_eclass_platform — Unrestricted File Upload vulnerability in Greek Universities Network Open eClass v.3.15 and earlier allows attackers to run arbitrary cod…

EPSS 3%public exploit CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (ADP)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 87.2.872 × 2017.4 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

Unrestricted File Upload vulnerability in Greek Universities Network Open eClass v.3.15 and earlier allows attackers to run arbitrary code via upload of crafted file to certbadge.php endpoint.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

open_eclass_platform3.15–CISA-ADP

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

refless-secure.com/2024/03/open-eclass-cve-2024-26503-unrestricted.html