Medium severity · published Nov 28, 2024
CVE-2024-11971
Guizhou Xiaoma Technology jpress Avatar upload cross site scripting
5.4
CVSS
0.5%
EPSS
No
On KEV
Description
A vulnerability classified as problematic was found in Guizhou Xiaoma Technology jpress 5.1.2. Affected by this vulnerability is an unknown functionality of the file /commons/attachment/upload of the component Avatar Handler. The manipulation of the argument files leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JP
jpress · Guizhou Xiaoma Technology
5.1.2 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-11971
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-11971
Exploit
https://github.com/dycccccccc/jpress/blob/main/JPRESS%20file%20upload%20leads%20to%20code%20execution.docx
Permissions Required
https://vuldb.com/?ctiid.286381
Third Party Advisory
https://vuldb.com/?id.286381
Third Party Advisory
https://vuldb.com/?submit.453637
More from jpress
6.1
CVE-2024-12348
Guizhou Xiaoma Technology jpress Attachment Upload upload AttachmentUtils.isUnSafe cross site scripting