PT-2024-31974 · Dedecms · Dedecms

Gaorenyusi · Published 2024-09-18 · Updated 2025-03-31 · CVE-2024-46373

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dedecms version 5.7.115

Description The issue is related to an arbitrary code execution via file upload vulnerability in the backend.

Recommendations For Dedecms version 5.7.115, as a temporary workaround, consider disabling file uploads in the backend until a patch is available. Restrict access to the file upload functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2024-46373

Affected Products

Dedecms

References · 7

• 🔥 https://github.com/gaorenyusi/gaorenyusi/blob/main/CVE-2024-46373.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-46373 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-46373 · Security Note
• https://twitter.com/CVEnew/status/1836534085767811140 · Twitter Post
• https://t.me/cvenotify/95167 · Telegram Post
• https://t.me/cvenotify/117069 · Telegram Post
• https://t.me/cvedetector/6027 · Telegram Post