CVE-2024-11314

CRITICAL

9.8

Description

The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to upload arbitrary files to any directory, leading to arbitrary code execution by uploading webshells.

CVE Details

CVSS v3.1 Score9.8

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published11/18/2024

Last Modified11/20/2024

Sourcenvd

Honeypot Sightings0

Affected Products

trcore:dvc

Weaknesses (CWE)

CWE-23CWE-434CWE-22CWE-434

References

https://www.twcert.org.tw/en/cp-139-8253-bc363-2.html(twcert@cert.org.tw)

https://www.twcert.org.tw/tw/cp-132-8252-91d6a-1.html(twcert@cert.org.tw)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.