PT-2024-16706 · Unknown · Grand Vice Info Webopac

Ming-Hung + 3 · Published 2024-11-11 · Updated 2024-11-18 · CVE-2024-11018

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Grand Vice Info Webopac versions up to 6.5.0/7.2.2

Description The issue is related to the lack of proper file type validation in the Webopac component, allowing unauthenticated remote attackers to upload and execute webshells. This could lead to arbitrary code execution on the server, potentially resulting in server compromise.

Recommendations For versions up to 6.5.0/7.2.2, upgrade the affected components immediately to mitigate exposure. As a temporary workaround, consider restricting access to the Webopac component until a patch is available. Avoid using the Webopac component for uploading files until the issue is resolved.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2024-11018

Affected Products

Grand Vice Info Webopac

References · 17

• https://twcert.org.tw/tw/cp-132-8213-3413b-1.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-11018 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-11018 · Security Note
• https://twcert.org.tw/en/cp-139-8214-64fa2-2.html · Vendor Advisory
• https://twitter.com/CVEnew/status/1855876285274415211 · Twitter Post
• https://twitter.com/oktsec/status/1855907736636026995 · Twitter Post
• https://t.me/cvenotify/101268 · Telegram Post
• https://twitter.com/transilienceai/status/1857478177108656573 · Twitter Post
• https://twitter.com/CveFindCom/status/1855875941995610444 · Twitter Post
• https://twitter.com/transilienceai/status/1857478190228451352 · Twitter Post
• https://t.me/cvenotify/102028 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1855966480191406240 · Twitter Post
• https://t.me/latest_high_impact_cve/1495 · Telegram Post
• https://twitter.com/transilienceai/status/1857478170825683174 · Twitter Post
• https://twitter.com/transilienceai/status/1857478182921974273 · Twitter Post