CVE-2024-6945 - Flute CMS Avatar Upload Page ImagesController.php unrestricted upload

Back Back to CVE browser

MEDIUM

Flute CMS Avatar Upload Page ImagesController.php unrestricted upload

Published Jul 21, 2024

5.3

MEDIUM

CVSS 4.0

EPSS 0.58%

Description

A vulnerability was found in Flute CMS 0.2.2.4-alpha. It has been classified as critical. This affects an unknown part of the file app/Core/Http/Controllers/Profile/ImagesController.php of the component Avatar Upload Page. The manipulation of the argument avatar leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272067.

Affected products

Vendor Flute Product CMS Default
n/a
- Version
  0.2.2.4-alpha
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Flute

CMS

n/a

Version	Status	Constraints
0.2.2.4-alpha	affected	-

Vendor Flute Product Cms Default
n/a
- Version
  0.2.2.4-alpha
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Flute

Cms

n/a

Version	Status	Constraints
0.2.2.4-alpha	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-434

Unrestricted Upload of File

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-47931
Advisory
https://github.com/DeepMountains/Mirage/blob/main/CVE5-1.md
exploitBroken Link
https://vuldb.com/?ctiid.272067
signaturepermissions-requiredPermissions Required
https://vuldb.com/?id.272067
vdb-entrytechnical-descriptionThird Party Advisory
https://vuldb.com/?submit.375189
third-party-advisoryThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-47931		Advisory
https://github.com/DeepMountains/Mirage/blob/main/CVE5-1.md		exploitBroken Link
https://vuldb.com/?ctiid.272067		signaturepermissions-requiredPermissions Required
https://vuldb.com/?id.272067		vdb-entrytechnical-descriptionThird Party Advisory
https://vuldb.com/?submit.375189		third-party-advisoryThird Party Advisory