CVE-2024-35591 - An arbitrary file upload vulnerability in O2OA v8.3.8 allows attackers to execute arbitrary code via uploading a crafted PDF file

MEDIUM

An arbitrary file upload vulnerability in O2OA v8.3.8 allows attackers to execute arbitrary code via uploading a crafted PDF file

Published May 24, 2024

5.4

MEDIUM

CVSS 3.1

EPSS 0.43%

An arbitrary file upload vulnerability in O2OA v8.3.8 allows attackers to execute arbitrary code via uploading a crafted PDF file.

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Zoneland	O2oa	unknown	Affected 8.3.8

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-35383		Advisory
https://github.com/o2oa/o2oa/issues/156		ExploitIssue TrackingVendor Advisory

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published May 24, 2024

Updated Feb 13, 2025

Reserved May 17, 2024

CISA Vulnrichment

Updated Aug 29, 2024

NVD

Status Analyzed

Modified Jun 17, 2026

Red Hat

No data

ENISA EUVD

Assigner mitre

Published May 24, 2024

Updated Feb 13, 2025

GitHub

No data