PT-2024-20442

CVE-2024-24550

Published

2024-06-24

Updated

2026-01-02

Description by

CVSS 4.0

8.9

High

MetricsAV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Bludit (affected versions not specified)

Description A security issue has been identified, allowing attackers with knowledge of the API token to upload arbitrary files through the "File API" which leads to arbitrary code execution on the server. This issue arises from improper handling of file uploads, enabling malicious actors to upload and execute PHP files.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Andreas Pfefferle

Vendors

Affected products

Weakness enumeration

CWE-77: Improper Neutralization of Special Elements used in a Command (\'Command Injection\')

CWE-502: Deserialization of Untrusted Data

CWE-434: Unrestricted Upload of File with Dangerous Type