CVE-2024-24551

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-24551
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-24551.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-24551
Published
2024-06-24T07:08:22.514Z
Modified
2026-07-15T01:49:09.097314323Z
Severity
  • 8.9 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CVSS Calculator
Summary
Bludit - Remote Code Execution (RCE) through Image API
Details

A security vulnerability has been identified in Bludit, allowing authenticated attackers to execute arbitrary code through the Image API. This vulnerability arises from improper handling of file uploads, enabling malicious actors to upload and execute PHP files.

Database specific 
{
    "cna_assigner": "NCSC.ch",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24551.json",
    "cwe_ids": [
        "CWE-434",
        "CWE-502",
        "CWE-77"
    ],
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "v3.9.0 beta 1"
                },
                {
                    "last_affected": "v3.9.0 beta 1"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/bludit/bludit

Affected ranges

Type
GIT
Repo
https://github.com/bludit/bludit
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
0a9c21a1e8f515181c6de9aa0500b9ff5a481093
Database specific 
{
    "cpe": "cpe:2.3:a:bludit:bludit:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.15.0"
        }
    ]
}

Affected versions

0.*
0.1
0.2
0.2-beta1
0.4-beta1
0.5
0.6-beta1
0.6-beta2
0.6.1
0.6.2
0.7
0.7-beta1
0.7.1
0.7.2
1.*
1.0-beta1
1.0-beta2
1.0-beta3
1.0.1
1.1.2
1.3
1.3-beta1
1.3-beta2
1.4
1.4a
1.5-beta1
1.5-beta2
1.5-beta3
1.5.1
1.5.2
1.6-beta1
2.*
2.0
2.0-alpha3
2.0-beta1
2.0-beta2
2.0-beta3
2.0-beta4
2.0-beta5
2.0-beta6
2.0-beta7
2.0.1
2.0.2
2.1
2.1.1
2.2
2.2.1
2.3
2.3-beta-1
2.3-beta-2
2.3.1
2.3.2
2.3.3
2.3.4
3.*
3.0.0
3.1.0
3.10.0
3.10.0a
3.11.0
3.11.0a
3.12.0
3.13.0
3.13.1
3.14.0
3.14.0-test
3.14.1
3.15.0
3.2.0
3.4-beta-1
3.4.0
3.5
3.5.0
3.6.0
3.6.1
3.7.0
3.7.1
3.8.0
3.8.1
3.9.0
3.9.0-beta1
3.9.1
3.9.2
4.*
4.0.0-rc1
Other
v
v2.*
v2.3.2
v3.*
v3.0.0-alpha-1
v3.0.0-alpha-2
v3.0.0-alpha-3
v3.0.0-alpha-4
v3.0.0-alpha-5
v3.0.0-beta-1
v3.0.0-beta-2
v3.0.0-rc-1
v3.0.0-rc-2
v3.0.0-rc-3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-24551.json"