CVE-2024-32491: Code Injection
An issue was discovered in Znuny and Znuny LTS 6.0.31 through 6.5.7 and Znuny 7.0.1 through 7.0.16 where a logged-in user can upload a file (via a manipulated AJAX Request) to an arbitrary writable location by traversing paths. Arbitrary code can be executed if this location is publicly available through the web server.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-32491?
CVE-2024-32491 has a high severity due to the potential for arbitrary file upload and code execution.
How do I fix CVE-2024-32491?
To fix CVE-2024-32491, update Znuny to version 7.0.17 or later, or ensure that file uploads are strictly validated.
Who is affected by CVE-2024-32491?
Users of Znuny versions 6.0.31 through 6.5.7 and 7.0.1 through 7.0.16 are affected by CVE-2024-32491.
What types of attacks can CVE-2024-32491 enable?
CVE-2024-32491 can enable attacks such as unauthenticated arbitrary code execution via malicious file uploads.
What are the implications of CVE-2024-32491 being exploited?
Exploitation of CVE-2024-32491 may lead to unauthorized access and control over affected systems.