PT-2024-28918 · Unknown · Tmall Demo

Rabbit · Published 2024-07-15 · Updated 2025-06-13 · CVE-2024-40553

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Tmall demo version 2024.07.03

Description The issue allows for an arbitrary file upload through the uploadUserHeadImage component.

Recommendations For Tmall demo version 2024.07.03, consider disabling the uploadUserHeadImage component until a patch is available to prevent arbitrary file uploads.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2024-40553

Affected Products

Tmall Demo

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-40553 · Security Note
• https://osv.dev/vulnerability/CVE-2024-40553 · Vendor Advisory
• https://t.me/cvenotify/125567 · Telegram Post
• https://t.me/cvenotify/125610 · Telegram Post
• https://t.me/cvedetector/879 · Telegram Post
• https://gitee.com/project_team/Tmall_demo/issues/IAANVC · Note