PT-2024-20443

CVE-2024-24551

Published

2024-06-24

Updated

2026-01-02

Description by

CVSS 4.0

8.9

High

MetricsAV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Bludit (affected versions not specified)

Description A security issue has been identified, allowing authenticated attackers to execute arbitrary code through the "Image API" endpoint. This issue arises from improper handling of file uploads, enabling malicious actors to upload and execute PHP files.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Andreas Pfefferle

Vendors

Affected products

Weakness enumeration

CWE-77: Improper Neutralization of Special Elements used in a Command (\'Command Injection\')

CWE-502: Deserialization of Untrusted Data

CWE-434: Unrestricted Upload of File with Dangerous Type