Skip to main content

Unrestricted Upload of File with Dangerous Type

CVE-2024-6647

Medium
4.7/10

Summary

A vulnerability classified as critical has been found in croogo/croogo versions 3.0.0 through 4.0.7, and 5.0.0-beta.1. This affects an unknown part of the file "admin/settings/settings/prefix/Theme" of the component "Setting Handler". The manipulation of the argument "Content-Type" leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-271053 was assigned to this vulnerability. NOTE: This vulnerability only affects products that the maintainer no longer supports.

  • LOW
  • NETWORK
  • LOW
  • UNCHANGED
  • NONE
  • HIGH
  • LOW
  • LOW

CWE-434 - Unrestricted Upload of File with dangerous type

'Unrestricted file upload with dangerous type' attacks involve an attacker uploading or transferring files of dangerous types to the server. The severity of such an attack depends upon the execution mechanism and the storage location of the uploaded file. Thus, it may range from simple defacement to arbitrary file execution, and complete system takeover.

References

Advisory Timeline

  • Published