High severity · published Oct 21, 2024
CVE-2024-10201
Wellchoose Administrative Management System - Arbitrary File Upload
8.8
CVSS
0.6%
EPSS
No
On KEV
Description
Administrative Management System from Wellchoose does not properly validate uploaded file types, allowing remote attackers with regular privileges to upload and execute webshells.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AM
Administrative Management System · Wellchoose
0 · source: vendor, NVD, CISA
Affected product
AM
Administrative Management System
Wellchoose
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-10201
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-10201
Third Party Advisory
https://www.twcert.org.tw/en/cp-139-8161-b8a6d-2.html
Third Party Advisory
https://www.twcert.org.tw/tw/cp-132-8160-756b6-1.html
More from Administrative Management System
8.8
CVE-2024-10202
Wellchoose Administrative Management System - OS Command Injection
7.5
CVE-2024-10200
Wellchoose Administrative Management System - Arbitrary File Read through Path Traversal