CVE-2024-58279

Name of the Vulnerable Software and Affected Versions appRain CMF version 4.0.5

Description The application allows authenticated administrative users to execute arbitrary code remotely. This is possible because of a flaw that permits the upload of malicious PHP files through the filemanager upload endpoint. Successful exploitation enables attackers to create a web shell and gain command execution capabilities by uploading a crafted PHP file to the site's uploads directory.

Recommendations Apply a fix or update to a newer version that addresses this issue. As a temporary workaround, restrict access to the filemanager upload endpoint.