A vulnerability was found in wanglongcn ltcms 1.0.20. It has been classified as critical. Affected is the function multiDownload of the file /api/file/multiDownload of the component API Endpoint. The manipulation of the argument file leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

History

Wed, 21 Aug 2024 19:30:00 +0000

Type Values Removed Values Added
First Time appeared Ltcms
Ltcms ltcms
CPEs cpe:2.3:a:ltcms:ltcms:1.0.20:*:*:*:*:*:*:*
Vendors & Products Ltcms
Ltcms ltcms

Thu, 15 Aug 2024 19:30:00 +0000

Type Values Removed Values Added
First Time appeared Wanglongcn
Wanglongcn ltcms
CPEs cpe:2.3:a:wanglongcn:ltcms:1.0.20:*:*:*:*:*:*:*
Vendors & Products Wanglongcn
Wanglongcn ltcms
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Tue, 13 Aug 2024 21:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in wanglongcn ltcms 1.0.20. It has been classified as critical. Affected is the function multiDownload of the file /api/file/multiDownload of the component API Endpoint. The manipulation of the argument file leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Title wanglongcn ltcms API Endpoint multiDownload server-side request forgery
Weaknesses CWE-918
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N'}


cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2024-08-15T18:36:28.889Z

Reserved: 2024-08-13T14:13:28.450Z

Link: CVE-2024-7742

cve-icon Vulnrichment

Updated: 2024-08-15T18:36:22.912Z

cve-icon NVD

Status : Analyzed

Published: 2024-08-13T21:15:16.627

Modified: 2024-08-21T19:08:47.707

Link: CVE-2024-7742

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.