Lucene search

MitreCVE-2024-22550

HistoryJan 26, 2024 - 3:15 p.m.

CVE-2024-22550

2024-01-2615:15:09

CWE-434

mitre

web.nvd.nist.gov

cve-2024-22550

arbitrary file upload

shopsite v14.0

security vulnerability

nvd

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.7

Confidence

High

EPSS

0.001

Percentile

27.9%

JSON

An arbitrary file upload vulnerability in the component /alsdemo/ss/mediam.cgi of ShopSite v14.0 allows attackers to execute arbitrary code via uploading a crafted SVG file.

Affected configurations

Nvd

Node

shopsiteshopsiteMatch14.0

VendorProductVersionCPE
shopsiteshopsite14.0cpe:2.3:a:shopsite:shopsite:14.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
shopsite	shopsite	14.0	cpe:2.3:a:shopsite:shopsite:14.0:::::::*

References

packetstormsecurity.com/files/176312/ShopSite-14.0-Cross-Site-Scripting.html

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.7

Confidence

High

EPSS

0.001

Percentile

27.9%

JSON

Related for CVE-2024-22550