PT-2024-21997 · Leantime · Leantime

Bruno Menna · Published 2024-04-03 · Updated 2024-08-28 · CVE-2024-27705

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions Leantime version 3.0.6

Description The issue allows attackers to execute arbitrary code via the upload of a crafted PDF file to the "files/browse" endpoint. This enables the execution of malicious scripts, potentially leading to unauthorized access or data manipulation.

Recommendations For Leantime version 3.0.6, consider disabling the file upload feature to the "files/browse" endpoint until a patch is available. Restrict access to this endpoint to minimize the risk of exploitation. Avoid using the file upload feature in this version until the issue is resolved.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-27705

Affected Products

Leantime

References · 4

• 🔥 https://github.com/b-hermes/vulnerability-research/tree/main/CVE-2024-27705 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-27705 · Security Note
• https://osv.dev/vulnerability/CVE-2024-27705 · Vendor Advisory
• https://t.me/cvenotify/75668 · Telegram Post