CVE-2024-12348: Guizhou Xiaoma Technology jpress Attachment Upload upload AttachmentUtils.isUnSafe cross site scripting
Description
A vulnerability was found in Guizhou Xiaoma Technology jpress 5.1.2. It has been classified as problematic. Affected is the function AttachmentUtils.isUnSafe of the file /commons/attachment/upload of the component Attachment Upload Handler. The manipulation of the argument files[] leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Es wurde eine problematische Schwachstelle in Guizhou Xiaoma Technology jpress 5.1.2 ausgemacht. Dabei betrifft es die Funktion AttachmentUtils.isUnSafe der Datei /commons/attachment/upload der Komponente Attachment Upload Handler. Durch die Manipulation des Arguments files[] mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei über das Netzwerk erfolgen. Der Exploit steht zur öffentlichen Verfügung.
Classification
CVE ID: CVE-2024-12348
CVSS Base Severity: MEDIUM
CVSS Base Score: 5.3
Affected Products
Vendor: Guizhou Xiaoma Technology
Product: jpress
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.05% (probability of being exploited)
EPSS Percentile: 17.81% (scored less or equal to compared to others)
EPSS Date: 2025-02-03 (when was this score calculated)
References
https://vuldb.com/?id.287268https://vuldb.com/?ctiid.287268
https://vuldb.com/?submit.454825
https://github.com/dycccccccc/jpress/blob/main/JPRESS%20has%20XSS%20vulnerability.docx