{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-8706","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","state":"PUBLISHED","assignerShortName":"VulDB","dateReserved":"2024-09-11T16:28:21.627Z","datePublished":"2024-09-11T23:31:06.227Z","dateUpdated":"2024-09-12T16:40:49.801Z"},"containers":{"cna":{"providerMetadata":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2024-09-11T23:31:06.227Z"},"title":"JFinalCMS com.cms.util.TemplateUtils update path traversal","problemTypes":[{"descriptions":[{"type":"CWE","cweId":"CWE-22","lang":"en","description":"CWE-22 Path Traversal"}]}],"affected":[{"vendor":"n/a","product":"JFinalCMS","versions":[{"version":"20240903","status":"affected"}],"modules":["com.cms.util.TemplateUtils"]}],"descriptions":[{"lang":"en","value":"A vulnerability was found in JFinalCMS up to 20240903. It has been classified as problematic. This affects the function update of the file /admin/template/update of the component com.cms.util.TemplateUtils. The manipulation of the argument fileName leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used."},{"lang":"de","value":"Es wurde eine Schwachstelle in JFinalCMS bis 20240903 ausgemacht. Sie wurde als problematisch eingestuft. Es betrifft die Funktion update der Datei /admin/template/update der Komponente com.cms.util.TemplateUtils. Durch Manipulation des Arguments fileName mit unbekannten Daten kann eine path traversal-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk erfolgen. Der Exploit steht zur öffentlichen Verfügung."}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":4.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":4.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":4,"vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N"}}],"timeline":[{"time":"2024-09-11T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2024-09-11T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2024-09-11T18:33:43.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"xinjiuW (VulDB User)","type":"reporter"}],"references":[{"url":"https://vuldb.com/?id.277215","name":"VDB-277215 | JFinalCMS com.cms.util.TemplateUtils update path traversal","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.277215","name":"VDB-277215 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.402346","name":"Submit #402346 | 10Web CMS <=1.0 Path Equivalence: 'fakedir/../realdir/filename'","tags":["third-party-advisory"]},{"url":"https://gitee.com/heyewei/JFinalcms/issues/IAOSJG","tags":["issue-tracking"]},{"url":"https://github.com/xingjiuW/cve/blob/main/wh.md","tags":["exploit"]}]},"adp":[{"affected":[{"vendor":"jfinalcms_project","product":"jfinalcms","cpes":["cpe:2.3:a:jfinalcms_project:jfinalcms:*:*:*:*:*:*:*:*"],"defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"20240903","versionType":"custom"}]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-09-12T16:39:53.664987Z","id":"CVE-2024-8706","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-09-12T16:40:49.801Z"}}]}}