CVE-2024-3705CWE-434

Unrestricted Upload of File with Dangerous Type vulnerability in OpenGnsys

High · published April 12, 2024

CVSS v3.1
8.8
EPSS
1%
Percentile
55.0
In the wild
Unconfirmed
What it is

Unrestricted file upload vulnerability in OpenGnsys affecting version 1.1.1d (Espeto). This vulnerability allows an attacker to send a POST request to the endpoint '/opengnsys/images/M_Icons.php' modifying the file extension, due to lack of file extension verification, resulting in a webshell injection.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00765 · 55.0th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2024-04-12T13:50Z
EPSS history
Timeline
  • 12 APR 13:50Z
    Unrestricted Upload of File with Dangerous Type vulnerability in OpenGnsys
    cvelistv5