CVE-2024-24550

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-24550

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-24550.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-24550

Published

2024-06-24T07:05:50.655Z

Modified

2026-07-15T01:49:07.209352333Z

Severity

8.9 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CVSS Calculator

Summary

Bludit - Remote Code Execution (RCE) through File API

Details

A security vulnerability has been identified in Bludit, allowing attackers with knowledge of the API token to upload arbitrary files through the File API which leads to arbitrary code execution on the server. This vulnerability arises from improper handling of file uploads, enabling malicious actors to upload and execute PHP files.

Database specific

{
    "cwe_ids": [
        "CWE-434",
        "CWE-502",
        "CWE-77"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24550.json",
    "cna_assigner": "NCSC.ch"
}

References

Affected packages

Git / github.com/bludit/bludit

Affected ranges

Type

GIT

Repo

https://github.com/bludit/bludit

Events

Introduced

29b7d74ead855a36ad270bbfca055e27f3ff7916

Last affected

29b7d74ead855a36ad270bbfca055e27f3ff7916

Database specific

{
    "cpe": "cpe:2.3:a:bludit:bludit:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "3.14.0"
        },
        {
            "last_affected": "3.14.0"
        },
        {
            "last_affected": "3.15.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

3.*

3.14.0

3.14.0-test

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-24550.json"