PT-2024-33566 · Unknown · Paxman Product Website Showcase

Stealthcopter · Published 2024-10-20 · Updated 2024-10-23 · CVE-2024-49611

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Paxman Product Website Showcase versions n/a through 1.0

Description The issue allows an unrestricted upload of files with dangerous types, enabling the upload of a web shell to a web server. This can potentially allow attackers to deploy malicious web shells to the server.

Recommendations For versions n/a through 1.0, consider disabling the file upload feature until a patch is available to prevent the upload of malicious files. Restrict access to the server to minimize the risk of exploitation. Avoid using the file upload functionality in the affected Paxman Product Website Showcase until the issue is resolved.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2024-49611

Affected Products

Paxman Product Website Showcase

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2024-49611 · Security Note
• https://osv.dev/vulnerability/CVE-2024-49611 · Vendor Advisory
• https://twitter.com/CveFindCom/status/1847918738059804874 · Twitter Post
• https://patchstack.com/database/vulnerability/product-websites-showcase/wordpress-product-website-showcase-plugin-1-0-arbitrary-file-upload-vulnerability?_s_id=cve · Note
• https://t.me/latest_high_impact_cve/1363 · Telegram Post
• https://t.me/cvenotify/99207 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1848017650913300703 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/product-websites-showcase/vulnerability/wordpress-product-website-showcase-plugin-1-0-arbitrary-file-upload-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/1847921586013171790 · Twitter Post
• https://t.me/cvedetector/8390 · Telegram Post