CVE-2024-4681: Campcodes Legal Case Management System Setting general-setting unrestricted upload
A vulnerability, which was classified as critical, was found in Campcodes Legal Case Management System 1.0. Affected is an unknown function of the file /admin/general-setting of the component Setting Handler. The manipulation of the argument favicon/logo leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-263622 is the identifier assigned to this vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
For Campcodes Legal Case Management System, mitigate the unrestricted upload by preventing remote access to /admin/general-setting (e.g., restrict the /admin/general-setting endpoint at the network/WAF/ACL so only trusted users/sources can reach it).
- Operational
Check for and remove any files uploaded via the favicon/logo argument in the affected /admin/general-setting functionality, then rotate/re-issue any credentials or tokens that may have been exposed through attacker uploads.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-4681?
CVE-2024-4681 is classified as a critical vulnerability.
How do I fix CVE-2024-4681?
To fix CVE-2024-4681, ensure proper validation and restrictions on the file upload functionality within the Setting Handler component.
What component is affected by CVE-2024-4681?
CVE-2024-4681 affects the Setting Handler component of the Campcodes Legal Case Management System 1.0.
What type of vulnerability is CVE-2024-4681?
CVE-2024-4681 is an unrestricted file upload vulnerability.
Which software version is impacted by CVE-2024-4681?
CVE-2024-4681 impacts version 1.0 of the Campcodes Legal Case Management System.