PT-2024-33467 · Unknown · Vasilis Kerasiotis Affiliator

João Pedro S Alcântara · Published 2024-10-20 · Updated 2024-10-24 · CVE-2024-49326

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vasilis Kerasiotis Affiliator versions 2.1.3 and earlier

Description The issue allows an attacker to upload a web shell to a web server due to an unrestricted file upload vulnerability. This enables the attacker to execute malicious code on the server.

Recommendations For versions 2.1.3 and earlier, update to version 2.1.4 to patch this critical vulnerability. As a temporary workaround, consider restricting file uploads to prevent potential exploitation until the update can be applied.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2024-49326

Affected Products

Vasilis Kerasiotis Affiliator

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2024-49326 · Security Note
• https://osv.dev/vulnerability/CVE-2024-49326 · Vendor Advisory
• https://t.me/cvenotify/99390 · Telegram Post
• https://patchstack.com/database/Wordpress/Plugin/affiliator-lite/vulnerability/wordpress-affiliator-plugin-2-1-3-arbitrary-file-upload-vulnerability?_s_id=cve · Note
• https://twitter.com/CveFindCom/status/1847926288524194298 · Twitter Post
• https://patchstack.com/database/vulnerability/affiliator-lite/wordpress-affiliator-plugin-2-1-3-arbitrary-file-upload-vulnerability?_s_id=cve · Note
• https://t.me/cvenotify/98884 · Telegram Post
• https://twitter.com/CVEnew/status/1847929796078030968 · Twitter Post
• https://t.me/cvedetector/8414 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1847953650716463255 · Twitter Post