CVE-2024-52004CWE-74

Remote code execution vulnerabilities in MediaCMS

High · published November 8, 2024

CVSS v4.0
8.7
EPSS
1%
Percentile
52.9
In the wild
Unconfirmed
What it is

MediaCMS is an open source video and media CMS, written in Python/Django and React, featuring a REST API. MediaCMS has been prone to vulnerabilities that upon special cases can lead to remote code execution. All versions before v4.1.0 are susceptible, and users are highly recommended to upgrade. The vulnerabilities are related with insufficient input validation while uploading media content. The condition to exploit the vulnerability is that the portal allows users to upload content. This issue has been patched in version 4.1.0. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00707 · 52.9th percentile
Weakness
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Published
2024-11-08T22:10Z
EPSS history
Timeline
  • 08 NOV 22:10Z
    Remote code execution vulnerabilities in MediaCMS
    cvelistv5