Vulnerability · Published Jun 24, 2024 · Assigned by NCSC.ch
CVE-2024-24551Bludit - Remote Code Execution (RCE) through Image API
High 8.9
In plain English
A high-severity command injection in Bludit from Bludit. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 55% of all known vulnerabilities).
Severity (CVSS 4.0)8.9High
Exploit odds (30 days)0.8%top 44.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A security vulnerability has been identified in Bludit, allowing authenticated attackers to execute arbitrary code through the Image API. This vulnerability arises from improper handling of file uploads, enabling malicious actors to upload and execute PHP files.
Affected products (as reported)
Weakness: CWE-77, CWE-502, CWE-434 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H