CVE-2024-29272: Malicious File Upload
Published Mar 22, 2024
·Updated
Arbitrary File Upload vulnerability in VvvebJs before version 1.7.5, allows unauthenticated remote attackers to execute arbitrary code and obtain sensitive information via the sanitizeFileName parameter in save.php.
Affected Software
2 affected componentsFixes available
npm/vvvebJs<1.7.5
1.7.5
Vvveb Vvvebjs<1.7.5
Remediation
Event History
Mar 22, 2024
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·04:15 AM
DescriptionSeverityWeakness
Advisory Published
via GitHub·06:30 AM
Frequently Asked Questions
1
What is the severity of CVE-2024-29272?
CVE-2024-29272 is classified as a high severity vulnerability due to its potential for arbitrary code execution and data compromise.
2
How do I fix CVE-2024-29272?
To fix CVE-2024-29272, upgrade the VvvebJs package to version 1.7.5 or later.
3
What systems are affected by CVE-2024-29272?
CVE-2024-29272 affects all versions of VvvebJs before 1.7.5.
4
Who can exploit the CVE-2024-29272 vulnerability?
CVE-2024-29272 can be exploited by unauthenticated remote attackers.
5
What type of vulnerability is CVE-2024-29272?
CVE-2024-29272 is classified as an Arbitrary File Upload vulnerability.