Vulnerability · Published Jun 24, 2024 · Assigned by NCSC.ch
CVE-2024-24550Bludit - Remote Code Execution (RCE) through File API
High 8.9
In plain English
A high-severity command injection in Bludit from Bludit. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).
Severity (CVSS 4.0)8.9High
Exploit odds (30 days)0.7%top 46.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A security vulnerability has been identified in Bludit, allowing attackers with knowledge of the API token to upload arbitrary files through the File API which leads to arbitrary code execution on the server. This vulnerability arises from improper handling of file uploads, enabling malicious actors to upload and execute PHP files.
Affected products (as reported)
Weakness: CWE-77, CWE-502, CWE-434 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H