CVE-2024-24024: Malicious File Upload
An arbitrary File download vulnerability exists in Novel-Plus v4.3.0-RC1 and prior at com.java2nb.common.controller.FileController: fileDownload(). An attacker can pass in specially crafted filePath and fieName parameters to perform arbitrary File download.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-24024?
CVE-2024-24024 has been classified as a medium to high severity vulnerability due to its potential for arbitrary file downloads.
How do I fix CVE-2024-24024?
To fix CVE-2024-24024, update your Novel-Plus application to version 4.3.0-RC2 or later.
What versions are affected by CVE-2024-24024?
CVE-2024-24024 affects Novel-Plus versions up to and including 4.3.0-RC1.
Can CVE-2024-24024 lead to data exposure?
Yes, CVE-2024-24024 can lead to unauthorized access and data exposure due to its arbitrary file download capability.
What is the nature of the vulnerability in CVE-2024-24024?
CVE-2024-24024 is an arbitrary file download vulnerability that allows attackers to manipulate file path and name parameters.