PT-2022-16716 · Zfaka · Zfaka

J0O1Ey · Published 2022-02-21 · Updated 2022-02-28 · CVE-2022-24553

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zfaka versions prior to 1.4.6

Description A security issue was discovered in the background file upload function, where the verification check is not strict enough. This weakness can lead to remote command execution.

Recommendations For versions prior to 1.4.6, update to version 1.4.6 or later to resolve the issue.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2022-24553

Affected Products

Zfaka

References · 4

• 🔥❌ https://github.com/zfaka-plus/zfaka/issues/260 · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2022-24553 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24553 · Security Note
• https://cnblogs.com/J0o1ey/p/15858138.html · Note