Medium severity · published Mar 22, 2024
CVE-2024-29272
Arbitrary File Upload vulnerability in VvvebJs before version 1.7.5, allows unauthenticated remote attackers to execute arbitrary code and obtain sensitive information via the…
6.5
CVSS
9.4%
EPSS
No
On KEV
Description
Arbitrary File Upload vulnerability in VvvebJs before version 1.7.5, allows unauthenticated remote attackers to execute arbitrary code and obtain sensitive information via the sanitizeFileName parameter in save.php.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)9.4% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VV
Vvvebjs · Vvveb
before 1.7.5 · source: NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-29272
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-29272
Patch
https://github.com/givanz/VvvebJs/commit/c6422cfd4d835c2fa6d512645e30015f24538ef0
Exploit
https://github.com/givanz/VvvebJs/issues/343
More from Vvvebjs
9.8
CVE-2024-25182
givanz VvvebJs 1.7.2 suffers from a File Upload vulnerability via save.php
9.8
CVE-2024-27480
givanz VvvebJs 1.7.2 is vulnerable to Insecure File Upload
9.1
CVE-2024-25181
A critical vulnerability has been identified in givanz VvvebJs 1.7.2, which allows both Server-Side Request Forgery (SSRF) and arbitrary file reading
7.5
CVE-2024-25183
givanz VvvebJs 1.7.2 is vulnerable to Directory Traversal via scan.php
6.1
CVE-2024-29271
Reflected Cross-Site Scripting (XSS) vulnerability in VvvebJs before version 1.7.7, allows remote attackers to execute arbitrary code and obtain sensitive information via the…