CVE-2024-24026: Malicious File Upload
An arbitrary File upload vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions at com.java2nb.system.controller.SysUserController: uploadImg(). An attacker can pass in specially crafted filename parameter to perform arbitrary File download.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-24026?
CVE-2024-24026 is classified as a high severity vulnerability due to its potential for arbitrary file upload and download.
How do I fix CVE-2024-24026?
To fix CVE-2024-24026, update the Novel-Plus application to version 4.3.0-RC2 or later.
What are the affected versions related to CVE-2024-24026?
CVE-2024-24026 affects Novel-Plus versions 4.3.0-RC1 and all versions prior to 4.2.0.
What can an attacker do with CVE-2024-24026?
An attacker exploiting CVE-2024-24026 can perform arbitrary file uploads and potentially execute further attacks by manipulating the filename parameter.
Is there a way to mitigate CVE-2024-24026 without upgrading?
Mitigation for CVE-2024-24026 without upgrading involves implementing strict validation on file uploads and restricting file types and sizes.