Cyber Posture

CVE-2024-46479

Critical

Published: 13 January 2025

Published
13 January 2025
Modified
07 October 2025
KEV Added
Patch
CVSS Score 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0450 89.2th percentile
Risk Priority 23 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2024-46479 is an arbitrary file upload vulnerability affecting Venki Supravizio BPM through version 18.0.1. This flaw, classified under CWE-434 (Unrestricted Upload of File with Dangerous Type), allows an authenticated attacker to upload a malicious file, potentially leading to remote code execution on the targeted system. The vulnerability was published on 2025-01-13 and carries a CVSS v3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), indicating critical severity due to its network accessibility, low attack complexity, low privileges required, and high impact across confidentiality, integrity, and availability with a changed scope.

An authenticated attacker with low privileges (PR:L) can exploit this vulnerability over the network without user interaction. By uploading a specially crafted malicious file through the affected component, the attacker achieves remote code execution, enabling full system compromise including data theft, modification, or further lateral movement within the environment.

Details on the vulnerability, including research findings, are documented in advisories available at https://github.com/Lorenzo-de-Sa/Vulnerability-Research and https://github.com/Lorenzo-de-Sa/Vulnerability-Research/blob/main/CVE-2024-46479.md, with the vendor page at https://www.venki.com.br/ferramenta-bpm/supravizio/. No specific patch or mitigation guidance is detailed in the available CVE information.

Details

CWE(s)
CWE-434

Affected Products

venki
supravizio bpm
≤ 18.0.1

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Arbitrary file upload vulnerability in Venki Supravizio BPM enables authenticated attackers to upload malicious files for remote code execution, directly facilitating exploitation of a public-facing application.

References