Critical severity · published Dec 29, 2024
CVE-2024-13022
taisan tarzan-cms Article Management UploadController.java UploadResponse unrestricted upload
9.8
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability, which was classified as critical, was found in taisan tarzan-cms 1.0.0. This affects the function UploadResponse of the file src/main/java/com/tarzan/cms/modules/admin/controller/common/UploadController.java of the component Article Management. The manipulation of the argument file leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TA
tarzan-cms · taisan
1.0.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-13022
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-13022
Exploit
https://gitee.com/taisan/tarzan-cms/issues/IBCUPG
Permissions Required
https://vuldb.com/?ctiid.289713
Third Party Advisory
https://vuldb.com/?id.289713
Third Party Advisory
https://vuldb.com/?submit.467471
More from tarzan-cms
9.8
CVE-2025-1113
taisan tarzan-cms Add Theme admin#themes upload deserialization
7.3
CVE-2026-90710
taisan tarzan-cms Theme Download Function ThemeService.java openConnection server-side request forgery