CVE-2024-13212: SingMR HouseRent AddHouseController.java upload unrestricted upload
Description
A vulnerability classified as critical has been found in SingMR HouseRent 1.0. This affects the function singleUpload/upload of the file src/main/java/com/house/wym/controller/AddHouseController.java. The manipulation of the argument file leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Es wurde eine Schwachstelle in SingMR HouseRent 1.0 entdeckt. Sie wurde als kritisch eingestuft. Es geht dabei um die Funktion singleUpload/upload der Datei src/main/java/com/house/wym/controller/AddHouseController.java. Durch Beeinflussen des Arguments file mit unbekannten Daten kann eine unrestricted upload-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk passieren. Der Exploit steht zur öffentlichen Verfügung.
Classification
CVE ID: CVE-2024-13212
CVSS Base Severity: MEDIUM
CVSS Base Score: 5.3
Affected Products
Vendor: SingMR
Product: HouseRent
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.05% (probability of being exploited)
EPSS Percentile: 17.82% (scored less or equal to compared to others)
EPSS Date: 2025-02-07 (when was this score calculated)
References
https://vuldb.com/?id.290817https://vuldb.com/?ctiid.290817
https://vuldb.com/?submit.471441
https://github.com/SingMR/HouseRent/issues/13
https://github.com/SingMR/HouseRent/issues/13#issue-2762125363