PT-2025-23119 · M2Soft · M2Soft Crownix Report & Ers

CVE-2024-57338 · Publicado 2025-05-28 · Atualizado 2025-05-28

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions M2Soft CROWNIX Report & ERS versions 5.x through 5.5.14.1070 M2Soft CROWNIX Report & ERS versions 7.x through 7.4.3.960 M2Soft CROWNIX Report & ERS versions 8.x through 8.2.0.345

Description An arbitrary file upload issue allows attackers to execute arbitrary code via supplying a crafted file.

Recommendations For versions 5.x through 5.5.14.1070, restrict access to file upload functionality to minimize the risk of exploitation. For versions 7.x through 7.4.3.960, consider disabling file upload features until a patch is available. For versions 8.x through 8.2.0.345, avoid using the file upload module to prevent potential code execution. At the moment, there is no information about a newer version that contains a fix for this issue.

Correção

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

CVE-2024-57338

Produtos afetados

M2Soft Crownix Report & Ers

Referências · 3

• https://m2soft.co.kr/sub/board/news.asp?mode=view&idx=2411 · Nota
• https://twitter.com/CVEnew/status/1927784575570231324 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2024-57338 · Nota de Segurança