CVE-2024-11984: SUNNET Corporate Training Management System - Unrestricted Upload of File with Dangerous Type
9.4
CVSS
Description
A unrestricted upload of file with dangerous type vulnerability in epaper draft function in Corporate Training Management System before 10.13 allows remote authenticated users to bypass file upload restrictions and perform arbitrary system commands with SYSTEM privilege via a crafted ZIP file.
Classification
CVE ID: CVE-2024-11984
CVSS Base Severity: CRITICAL
CVSS Base Score: 9.4
Affected Products
Vendor: SUNNET Technology Co., Ltd.
Product: Corporate Training Management System
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.04% (probability of being exploited)
EPSS Percentile: 11.44% (scored less or equal to compared to others)
EPSS Date: 2025-02-03 (when was this score calculated)