CVE-2024-27114 | THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

Description

A unauthenticated Remote Code Execution (RCE) vulnerability is found in the SO Planning online planning tool. If the public view setting is enabled, a attacker can upload a PHP-file that will be available for execution for a few milliseconds before it is removed, leading to execution of code on the underlying system. The vulnerability has been remediated in version 1.52.02.

Reserved 2024-02-19 | Published 2024-09-11 | Updated 2024-10-16 | Assigner DIVD

HIGH: 8.9CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:N/AU:Y/R:I/V:C/RE:M/U:Red

Problem types

CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

Product status

Default status

unaffected

before 1.52.01

affected

Credits

Wietse Boonstra finder

Hidde Smit finder

Max van der Horst analyst

References

csirt.divd.nl/CVE-2024-27114 third-party-advisory

cve.org (CVE-2024-27114)

nvd.nist.gov (CVE-2024-27114)

Download JSON

https://cve.threatint.com/CVE/CVE-2024-27114

Support options

Helpdesk Chat, Email, Knowledgebase
Telegram Chat

Subscribe to our newsletter to learn more about our work.