CVE-2024-3778 - Vulnerability Details - OpenCVE

The file upload functionality of Ai3 QbiBot does not properly restrict types of uploaded files, allowing remote attackers with administrator privilege to upload files with dangerous type containing malicious code.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://www.twcert.org.tw/tw/cp-132-7732-9a54e-1.html

History

No history.

MITRE

Status: PUBLISHED

Assigner: twcert

Published: 2024-04-15T03:41:00.113Z

Updated: 2024-08-01T20:20:01.586Z

Reserved: 2024-04-15T03:09:24.829Z

Link: CVE-2024-3778

Vulnrichment

Updated: 2024-08-01T20:20:01.586Z

NVD

Status : Awaiting Analysis

Published: 2024-04-15T04:15:16.747

Modified: 2024-11-21T09:30:22.783

Link: CVE-2024-3778

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-3778", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "state": "PUBLISHED", "assignerShortName": "twcert", "dateReserved": "2024-04-15T03:09:24.829Z", "datePublished": "2024-04-15T03:41:00.113Z", "dateUpdated": "2024-08-01T20:20:01.586Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "QbiBot ", "vendor": "Ai3 ", "versions": [{"lessThanOrEqual": "8.0.4", "status": "affected", "version": "earlier", "versionType": "custom"}]}], "datePublic": "2024-04-15T03:39:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The file upload functionality of Ai3 QbiBot does not properly restrict types of uploaded files, allowing remote attackers with administrator privilege to upload files with dangerous type containing malicious code."}], "value": "The file upload functionality of Ai3 QbiBot does not properly restrict types of uploaded files, allowing remote attackers with administrator privilege to upload files with dangerous type containing malicious code."}], "impacts": [{"capecId": "CAPEC-650", "descriptions": [{"lang": "en", "value": "CAPEC-650 Upload a Web Shell to a Web Server"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2024-04-15T03:41:00.113Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://www.twcert.org.tw/tw/cp-132-7732-9a54e-1.html"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Update to v8.0.5 or latter version, or contact vendor for remediation."}], "value": "Update to v8.0.5 or latter version, or contact vendor for remediation."}], "source": {"advisory": "TVN-202404005", "discovery": "EXTERNAL"}, "title": "Ai3 QbiBot - Unrestricted File Upload", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"affected": [{"vendor": "ai3", "product": "qbibot", "cpes": ["cpe:2.3:h:ai3:qbibot:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "8.0.4", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-25T18:39:25.803642Z", "id": "CVE-2024-3778", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-25T18:46:18.471Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T20:20:01.586Z"}, "title": "CVE Program Container", "references": [{"tags": ["third-party-advisory", "x_transferred"], "url": "https://www.twcert.org.tw/tw/cp-132-7732-9a54e-1.html"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-7732-9a54e-1.html", "tags": ["third-party-advisory", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T20:20:01.586Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-3778", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-07-25T18:39:25.803642Z"}}}], "affected": [{"cpes": ["cpe:2.3:h:ai3:qbibot:*:*:*:*:*:*:*:*"], "vendor": "ai3", "product": "qbibot", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "8.0.4"}], "defaultStatus": "unaffected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-25T18:46:09.357Z"}}], "cna": {"title": "Ai3 QbiBot - Unrestricted File Upload", "source": {"advisory": "TVN-202404005", "discovery": "EXTERNAL"}, "impacts": [{"capecId": "CAPEC-650", "descriptions": [{"lang": "en", "value": "CAPEC-650 Upload a Web Shell to a Web Server"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Ai3 ", "product": "QbiBot ", "versions": [{"status": "affected", "version": "earlier", "versionType": "custom", "lessThanOrEqual": "8.0.4"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update to v8.0.5 or latter version, or contact vendor for remediation.", "supportingMedia": [{"type": "text/html", "value": "Update to v8.0.5 or latter version, or contact vendor for remediation.", "base64": false}]}], "datePublic": "2024-04-15T03:39:00.000Z", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-7732-9a54e-1.html", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "The file upload functionality of Ai3 QbiBot does not properly restrict types of uploaded files, allowing remote attackers with administrator privilege to upload files with dangerous type containing malicious code.", "supportingMedia": [{"type": "text/html", "value": "The file upload functionality of Ai3 QbiBot does not properly restrict types of uploaded files, allowing remote attackers with administrator privilege to upload files with dangerous type containing malicious code.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2024-04-15T03:41:00.113Z"}}}, "cveMetadata": {"cveId": "CVE-2024-3778", "state": "PUBLISHED", "dateUpdated": "2024-08-01T20:20:01.586Z", "dateReserved": "2024-04-15T03:09:24.829Z", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "datePublished": "2024-04-15T03:41:00.113Z", "assignerShortName": "twcert"}, "dataVersion": "5.1"}