CVE-2024-13133
Published: 05 January 2025
Description
A vulnerability, which was classified as critical, has been found in ZeroWdd studentmanager 1.0. This issue affects the function addStudent/editStudent of the file src/main/Java/com/wdd/studentmanager/controller/StudentController. java. The manipulation of the argument file leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Security Summary
CVE-2024-13133 is a critical vulnerability in ZeroWdd studentmanager version 1.0, affecting the addStudent and editStudent functions within the file src/main/java/com/wdd/studentmanager/controller/StudentController.java. The flaw allows unrestricted file upload through manipulation of the 'file' argument, enabling attackers to upload arbitrary files remotely. It is associated with CWE-284 (Improper Access Control) and CWE-434 (Unrestricted Upload of File with Dangerous Type), and carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
An attacker with low privileges (PR:L) can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation grants limited impacts: low confidentiality (C:L) via potential access to uploaded files, low integrity (I:L) through malicious file modifications, and low availability (A:L) disruption. The exploit has been publicly disclosed, increasing the risk of remote initiation.
Advisories referenced in GitHub issues #16 (including comment #2755347097) and VulDB entries (ctiid.290207 and id.290207) detail the vulnerability but do not specify patches or mitigations in the available information. Security practitioners should review these sources for updates on remediation.
Details
- CWE(s)