PT-2024-35775 · Taiga · Taiga

Avihay Eldad + 2 · Published 2024-11-26 · Updated 2024-11-26 · CVE-2024-53555

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Taiga version 6.8.1

Description A CSV injection issue allows attackers to execute arbitrary code via uploading a crafted CSV file. This is achieved by loading a specifically manipulated CSV file, enabling the execution of arbitrary code.

Recommendations For Taiga version 6.8.1, consider disabling the CSV upload feature until a patch is available to prevent exploitation. Restrict access to areas where CSV files can be uploaded to minimize the risk of arbitrary code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

CVE-2024-53555

Affected Products

Taiga

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-53555 · Security Note
• https://twitter.com/CVEnew/status/1861451866539991249 · Twitter Post
• https://t.me/cvenotify/102620 · Telegram Post
• https://drive.google.com/file/d/1M4UjoTUqlPWLYjevCuE3WhdUqQkRj0-r/view?usp=drive_link · Note
• https://gist.githubusercontent.com/Tommywarren/bb1287d17ac83f2e277c0dea798f6ff7/raw/e21132dbaf81e210c2e1cb5babfc4dcca9b2c0d8/CVE-2024-53555 · Note