PT-2023-9689 · Mediacms · Mediacms

Vladimir Razov · Published 2023-10-17 · Updated 2024-11-12 · CVE-2024-52004

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions MediaCMS versions prior to 4.1.0

Description The issue is related to insufficient input validation while uploading media content, which can lead to remote code execution under special conditions. This can be exploited if the portal allows users to upload content. The vulnerability has been patched in version 4.1.0.

Recommendations For versions prior to 4.1.0, upgrade to version 4.1.0 to fix the issue. As a temporary workaround, consider restricting access to the media upload feature until the upgrade is applied. Avoid using the media upload feature in the affected API endpoint until the issue is resolved. At the moment, there are no known workarounds for this vulnerability other than upgrading to the patched version.

Exploit

Fix

Special Elements Injection

OS Command Injection

Weakness Enumeration

CWE-74

CWE-78

Related Identifiers

BDU:2024-10111

CVE-2024-52004

GHSA-X3P4-4442-Q2C3

Affected Products

Mediacms

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52004.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-52004 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-10111 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-52004 · Security Note
• https://github.com/mediacms-io/mediacms/releases/tag/v4.1.0 · Note
• https://github.com/mediacms-io/mediacms/security/advisories/GHSA-x3p4-4442-q2c3 · Note
• https://github.com/mediacms-io/mediacms/blob/main/docs/admins_docs.md · Note
• https://t.me/cvenotify/101154 · Telegram Post
• https://twitter.com/CveFindCom/status/1855015326854864917 · Twitter Post
• https://medium.com/@MediaCMS.io/fixing-remote-code-execution-vulnerabilities-in-mediacms-b46ace5fbb7d · Note
• https://t.me/cvedetector/10246 · Telegram Post
• https://twitter.com/CVEnew/status/1855015828724326663 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1855113342416834679 · Twitter Post