CVE-2024-43033

PoC ×2—

CVSS 3.1

8.8 high

EPSS

<1%p60

Published

Aug 22, 2024 (Aug 22, 2024)

Modified

Jun 17, 2026

Description

JPress through 5.1.1 on Windows has an arbitrary file upload vulnerability that could cause arbitrary code execution via ::$DATA to AttachmentController, such as a .jsp::$DATA file to io.jpress.web.commons.controller.AttachmentController#upload. NOTE: this is unrelated to the attack vector for CVE-2024-32358.

Vendors: jpress
Products: jpress
Weakness: CWE-69
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.0%)

In the news0 stories

No ingested article mentions this CVE yet.