PT-2025-50752 · Compuware · Compuware Istrobe Web Version 20.13

Guest + 1 · Published 2025-12-11 · Updated 2025-12-11 · CVE-2024-58298

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Compuware iStrobe Web version 20.13

Description The software contains a pre-authentication remote code execution issue. Unauthenticated attackers can upload malicious JSP files through a path traversal flaw in the file upload form. Exploitation involves sending POST requests to the uploaded JSP endpoint, utilizing the fileName parameter to upload a web shell and execute arbitrary commands.

Recommendations Apply updates to address the path traversal issue in the file upload form. Restrict access to the file upload functionality. Monitor network traffic for suspicious POST requests targeting the JSP endpoint.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2024-58298

Affected Products

Compuware Istrobe Web Version 20.13

References · 6

• 🔥 https://exploit-db.com/exploits/51991 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-58298 · Security Note
• https://twitter.com/0dayPublishing/status/1999236621133062392 · Twitter Post
• https://bmc.com/support · Note
• https://vulncheck.com/advisories/compuware-istrobe-web-pre-auth-remote-code-execution-via-file-upload · Note
• https://bmc.com · Note