CVE-2023-34845
MediumCVSS 5.4Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
Bludit v3.14.1 was discovered to contain an arbitrary file upload vulnerability in the component /admin/new-content. This vulnerability allows attackers to execute arbitrary web scripts or HTML via uploading a crafted SVG file.
Risk Assessment
This vulnerability may lead to malicious code execution on the server, posing a serious threat to the application's security and user data.
Recommendation
It is recommended to update to the latest version of Bludit and implement additional security measures to restrict unauthorized file uploads.
Original NVD description (English source)
Bludit v3.14.1 was discovered to contain an arbitrary file upload vulnerability in the component /admin/new-content. This vulnerability allows attackers to execute arbitrary web scripts or HTML via uploading a crafted SVG file. NOTE: the product's security model is that users are trusted by the administrator to insert arbitrary content (users cannot create their own accounts through self-registration).