CVE-2024-11979: Interinfo DreamMaker - Unrestricted File Upload through Path Traversal

Published Nov 29, 2024

Updated

DreamMaker from Interinfo has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to upload arbitrary files to any directory, leading to arbitrary code execution by uploading webshells.

Affected Software

1 affected component

Interinfo DreamMaker

Remediation

Information

Update to version 2024/09/26 or later.

Event History

Nov 29, 2024

CVE Published

via MITRE·02:12 AM

Data Sourced

via MITRE·02:12 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·03:15 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-11979?

CVE-2024-11979 is a high-severity vulnerability due to the risk of arbitrary code execution.

How do I fix CVE-2024-11979?

To mitigate CVE-2024-11979, ensure that file uploads are restricted to specific file types and validate directory access.

Who is affected by CVE-2024-11979?

CVE-2024-11979 affects users of Interinfo DreamMaker that allow unrestricted file uploads.

What kind of attacks can CVE-2024-11979 enable?

CVE-2024-11979 can enable unauthenticated remote attackers to upload webshells and execute arbitrary code.

Is CVE-2024-11979 exploitable without authentication?

Yes, CVE-2024-11979 can be exploited by unauthenticated attackers, making it particularly dangerous.