CVE-2024-1918CWE-434

Byzoro Smart S42 Management Platform userattestation.php unrestricted upload

Medium · published February 27, 2024

CVSS v3.1
4.7
EPSS
2%
Percentile
83.4
In the wild
Unconfirmed
What it is

A vulnerability has been found in Byzoro Smart S42 Management Platform up to 20240219 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /useratte/userattestation.php. The manipulation of the argument hidwel leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-254839. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v3.1
4.7 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.02333 · 83.4th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2024-02-27T13:00Z
EPSS history
Timeline
  • 27 FEB 13:00Z
    Byzoro Smart S42 Management Platform userattestation.php unrestricted upload
    cvelistv5