PT-2024-27049 · Nukeviet+1 · Nukeviet+1

Published 2024-06-10 · Updated 2025-09-15 · CVE-2024-36528

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions nukeviet versions 4.5 and earlier nukeviet-egov versions 1.2.02 and earlier

Description The issue is related to a Deserialization vulnerability, which can result in code execution. This can be achieved via the "/admin/extensions/download.php" and "/admin/extensions/upload.php" API endpoints.

Recommendations For nukeviet versions 4.5 and earlier, consider disabling access to the "/admin/extensions/download.php" and "/admin/extensions/upload.php" API endpoints until a patch is available. For nukeviet-egov versions 1.2.02 and earlier, restrict access to the "/admin/extensions/download.php" and "/admin/extensions/upload.php" API endpoints to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2024-36528

GHSA-MHJ4-VRCV-X4XC

Affected Products

Nukeviet

Nukeviet-Egov

References · 9

• 🔥 https://mat4mee.notion.site/2-bug-chains-in-nukeViet-lead-to-RCE-bdd42b20b05a448fbe87c752b41bb15f · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-36528 · Security Note
• https://osv.dev/vulnerability/CVE-2024-36528 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mhj4-vrcv-x4xc · Vendor Advisory
• https://github.com/nukeviet/nukeviet · Note
• https://twitter.com/VulmonFeeds/status/1800207680650301771 · Twitter Post
• https://t.me/cvenotify/125317 · Telegram Post
• https://t.me/cveNotify/135472 · Telegram Post
• https://t.me/cvenotify/91604 · Telegram Post