CVE-2024-29272: Malicious File Upload

Q: What is the severity of CVE-2024-29272?

CVE-2024-29272 is classified as a high severity vulnerability due to its potential for arbitrary code execution and data compromise.

Q: How do I fix CVE-2024-29272?

To fix CVE-2024-29272, upgrade the VvvebJs package to version 1.7.5 or later.

Q: What systems are affected by CVE-2024-29272?

CVE-2024-29272 affects all versions of VvvebJs before 1.7.5.

Q: Who can exploit the CVE-2024-29272 vulnerability?

CVE-2024-29272 can be exploited by unauthenticated remote attackers.

Q: What type of vulnerability is CVE-2024-29272?

CVE-2024-29272 is classified as an Arbitrary File Upload vulnerability.

Published Mar 22, 2024

Updated

Arbitrary File Upload vulnerability in VvvebJs before version 1.7.5, allows unauthenticated remote attackers to execute arbitrary code and obtain sensitive information via the sanitizeFileName parameter in save.php.

Affected Software

2 affected componentsFixes available

npm/vvvebJs<1.7.5

1.7.5

Vvveb Vvvebjs<1.7.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade npm/vvvebJs to a version that resolves this vulnerability.
Fixed in 1.7.5
Upgrade
Upgrade VvvebJs to a version that resolves this vulnerability.
Fixed in 1.7.5

Event History

Mar 22, 2024

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·04:15 AM

DescriptionSeverityWeakness

Advisory Published

via GitHub·06:30 AM

Apr 7, 58713

Event

via FIRST·02:41 AM

Frequently Asked Questions

What is the severity of CVE-2024-29272?

CVE-2024-29272 is classified as a high severity vulnerability due to its potential for arbitrary code execution and data compromise.

How do I fix CVE-2024-29272?