CVE-2024-34906: Malicious File Upload
Published May 15, 2024
·Updated
An arbitrary file upload vulnerability in dootask v0.30.13 allows attackers to execute arbitrary code via uploading a crafted PDF file.
Affected Software
1 affected component
dootask dootask=0.30.13
Event History
Jan 1, 1970
CVE Published
via MITRE·12:00 AM
May 15, 2024
CVE Published
via NVD·08:15 PM
Aug 28, 2024
Data Sourced
via MITRE·08:49 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2024-34906?
CVE-2024-34906 is classified as a critical severity vulnerability as it allows arbitrary code execution through file uploads.
2
How do I fix CVE-2024-34906?
To fix CVE-2024-34906, upgrade Dootask to version 0.30.14 or later which addresses this vulnerability.
3
What types of attacks are possible due to CVE-2024-34906?
CVE-2024-34906 can potentially lead to remote code execution attacks if an attacker uploads a malicious PDF file.
4
Is CVE-2024-34906 present in earlier versions of Dootask?
Yes, CVE-2024-34906 affects Dootask version 0.30.13 and earlier versions.
5
What mitigation steps can be taken for CVE-2024-34906?
Until an upgrade can be applied, restrict file uploads and validate file types to mitigate the risk of CVE-2024-34906.