CVE-2024-8694

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-8694", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2024-09-11T11:41:14.257Z", "datePublished": "2024-09-11T21:00:08.197Z", "dateUpdated": "2024-09-12T16:08:32.325Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2024-09-11T21:00:08.197Z"}, "title": "JFinalCMS com.cms.controller.admin.TemplateController update path traversal", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-22", "lang": "en", "description": "CWE-22 Path Traversal"}]}], "affected": [{"vendor": "n/a", "product": "JFinalCMS", "versions": [{"version": "20240903", "status": "affected"}], "modules": ["com.cms.controller.admin.TemplateController"]}], "descriptions": [{"lang": "en", "value": "A vulnerability, which was classified as problematic, was found in JFinalCMS up to 20240903. This affects the function update of the file /admin/template/update of the component com.cms.controller.admin.TemplateController. The manipulation of the argument fileName leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used."}, {"lang": "de", "value": "Es wurde eine problematische Schwachstelle in JFinalCMS bis 20240903 gefunden. Es geht dabei um die Funktion update der Datei /admin/template/update der Komponente com.cms.controller.admin.TemplateController. Dank der Manipulation des Arguments fileName mit unbekannten Daten kann eine path traversal-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4.7, "vectorString": "AV:N/AC:L/Au:M/C:N/I:P/A:P"}}], "timeline": [{"time": "2024-09-11T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2024-09-11T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2024-09-11T13:46:26.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "wavesky (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.277167", "name": "VDB-277167 | JFinalCMS com.cms.controller.admin.TemplateController update path traversal", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.277167", "name": "VDB-277167 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.401858", "name": "Submit #401858 | 10Web CMS <=1.0 Unrestricted Upload", "tags": ["third-party-advisory"]}, {"url": "https://gitee.com/heyewei/JFinalcms/issues/IAOKSQ", "tags": ["issue-tracking"]}, {"url": "https://github.com/wave-to/SomeCms/blob/main/JFinalCMS.md", "tags": ["exploit"]}]}, "adp": [{"affected": [{"vendor": "jfinalcms_project", "product": "jfinalcms", "cpes": ["cpe:2.3:a:jfinalcms_project:jfinalcms:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "20240903", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-12T16:05:52.467442Z", "id": "CVE-2024-8694", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-12T16:08:32.325Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-8694", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-12T16:05:52.467442Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:jfinalcms_project:jfinalcms:*:*:*:*:*:*:*:*"], "vendor": "jfinalcms_project", "product": "jfinalcms", "versions": [{"status": "affected", "version": "0", "lessThan": "20240903", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-12T16:08:24.611Z"}}], "cna": {"title": "JFinalCMS com.cms.controller.admin.TemplateController update path traversal", "credits": [{"lang": "en", "type": "reporter", "value": "wavesky (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.8, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.8, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4.7, "vectorString": "AV:N/AC:L/Au:M/C:N/I:P/A:P"}}], "affected": [{"vendor": "n/a", "modules": ["com.cms.controller.admin.TemplateController"], "product": "JFinalCMS", "versions": [{"status": "affected", "version": "20240903"}]}], "timeline": [{"lang": "en", "time": "2024-09-11T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2024-09-11T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2024-09-11T13:46:26.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.277167", "name": "VDB-277167 | JFinalCMS com.cms.controller.admin.TemplateController update path traversal", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.277167", "name": "VDB-277167 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.401858", "name": "Submit #401858 | 10Web CMS <=1.0 Unrestricted Upload", "tags": ["third-party-advisory"]}, {"url": "https://gitee.com/heyewei/JFinalcms/issues/IAOKSQ", "tags": ["issue-tracking"]}, {"url": "https://github.com/wave-to/SomeCms/blob/main/JFinalCMS.md", "tags": ["exploit"]}], "descriptions": [{"lang": "en", "value": "A vulnerability, which was classified as problematic, was found in JFinalCMS up to 20240903. This affects the function update of the file /admin/template/update of the component com.cms.controller.admin.TemplateController. The manipulation of the argument fileName leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used."}, {"lang": "de", "value": "Es wurde eine problematische Schwachstelle in JFinalCMS bis 20240903 gefunden. Es geht dabei um die Funktion update der Datei /admin/template/update der Komponente com.cms.controller.admin.TemplateController. Dank der Manipulation des Arguments fileName mit unbekannten Daten kann eine path traversal-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Path Traversal"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2024-09-11T21:00:08.197Z"}}}, "cveMetadata": {"cveId": "CVE-2024-8694", "state": "PUBLISHED", "dateUpdated": "2024-09-12T16:08:32.325Z", "dateReserved": "2024-09-11T11:41:14.257Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2024-09-11T21:00:08.197Z", "assignerShortName": "VulDB"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"modules": ["com.cms.controller.admin.TemplateController"], "product": "JFinalCMS", "vendor": "n/a", "versions": [{"status": "affected", "version": "20240903"}]}], "source": "cna@vuldb.com"}, {"affectedData": [{"cpes": ["cpe:2.3:a:jfinalcms_project:jfinalcms:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "jfinalcms", "vendor": "jfinalcms_project", "versions": [{"lessThan": "20240903", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:heyewei:jfinalcms:*:*:*:*:*:*:*:*", "matchCriteriaId": "125439AC-0CDC-4C23-8D7C-CA22D3964B71", "versionEndExcluding": "20240903", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability, which was classified as problematic, was found in JFinalCMS up to 20240903. This affects the function update of the file /admin/template/update of the component com.cms.controller.admin.TemplateController. The manipulation of the argument fileName leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used."}, {"lang": "es", "value": "Hasta el 20240903 se encontr\u00f3 una vulnerabilidad clasificada como problem\u00e1tica en JFinalCMS. Afecta a la funci\u00f3n update del archivo /admin/template/update del componente com.cms.controller.admin.TemplateController. La manipulaci\u00f3n del argumento fileName provoca un path traversal. Es posible iniciar el ataque de forma remota. El exploit se ha hecho p\u00fablico y puede utilizarse."}], "id": "CVE-2024-8694", "lastModified": "2026-06-17T08:23:07.723", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "MULTIPLE", "availabilityImpact": "PARTIAL", "baseScore": 4.7, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:M/C:N/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 6.4, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.8, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 2.5, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-8694", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-12T16:05:52.467442Z", "version": "2.0.3"}}]}, "published": "2024-09-11T21:15:10.863", "references": [{"source": "cna@vuldb.com", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "url": "https://gitee.com/heyewei/JFinalcms/issues/IAOKSQ"}, {"source": "cna@vuldb.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/wave-to/SomeCms/blob/main/JFinalCMS.md"}, {"source": "cna@vuldb.com", "tags": ["Permissions Required", "VDB Entry"], "url": "https://vuldb.com/?ctiid.277167"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?id.277167"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?submit.401858"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{}