PT-2024-24613 · Znuny+1 · Znuny+1

Martino Spagnuolo · Published 2024-04-29 · Updated 2025-09-02 · CVE-2024-32491

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Znuny versions 6.0.31 through 6.5.7 Znuny versions 7.0.1 through 7.0.16

Description An issue allows a logged-in user to upload a file to an arbitrary writable location by traversing paths via a manipulated AJAX request. If this location is publicly available through the web server, arbitrary code can be executed. The vulnerability is related to the Filename parameter in the FormIDAddFile function of Kernel/System/Web/UploadCache/DB.pm.

Recommendations For Znuny versions 6.0.31 through 6.5.7, upgrade to a newer version to mitigate the risk of remote attacks. For Znuny versions 7.0.1 through 7.0.16, upgrade to a newer version to mitigate the risk of remote attacks. As a temporary workaround, consider restricting access to the FormIDAddFile function in Kernel/System/Web/UploadCache/DB.pm until a patch is available. Avoid using the Filename parameter in the affected upload functionality until the issue is resolved.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-32491

Affected Products

Debian

Znuny

References · 13

• https://osv.dev/vulnerability/UBUNTU-CVE-2024-32491 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-32491 · Vendor Advisory
• https://znuny.org/en/advisories/zsa-2024-01 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-32491 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-32491 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-32491 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-32491 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-32491 · Security Note
• https://t.me/cveNotify/134141 · Telegram Post
• https://znuny.com · Note
• https://t.me/cvenotify/78424 · Telegram Post
• https://twitter.com/oktsec/status/1784848313809809900 · Twitter Post
• https://twitter.com/CVEnew/status/1784989142826270797 · Twitter Post