CVE-2024-13144
Published: 06 January 2025
Description
A vulnerability classified as critical has been found in zhenfeng13 My-Blog 1.0. Affected is the function uploadFileByEditomd of the file src/main/java/com/site/blog/my/core/controller/admin/BlogController.java. The manipulation of the argument editormd-image-file leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Security Summary
CVE-2024-13144 is a vulnerability classified as critical in zhenfeng13 My-Blog 1.0, affecting the uploadFileByEditomd function within the file src/main/java/com/site/blog/my/core/controller/admin/BlogController.java. The issue stems from manipulation of the editormd-image-file argument, enabling unrestricted file upload (CWE-284, CWE-434). It has a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and was published on 2025-01-06.
A remote attacker with low privileges, such as an authenticated user, can exploit this vulnerability over the network with low attack complexity and no user interaction. Exploitation allows arbitrary file uploads, potentially compromising confidentiality, integrity, and availability to a low degree. The exploit has been disclosed publicly and may be used.
Advisories and discussions on mitigation are available in GitHub issues such as https://github.com/ZHENFENG13/My-Blog/issues/140 and VulDB entries including https://vuldb.com/?id.290232.
Details
- CWE(s)