CVE-2024-24398
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk79th percentile - higher than 79% of all known CVEs
Summary
A Directory Traversal vulnerability in Stimulsoft Dashboard.JS before version 2024.1.2 allows a remote attacker to execute arbitrary code via a crafted payload in the fileName parameter of the Save function.
Risk Assessment
An attacker can gain unauthorized access to the server's file system, potentially leading to full application compromise and data exfiltration.
Recommendation
Immediately update Stimulsoft Dashboard.JS to version 2024.1.2 or later, and restrict access to the Save function to trusted users.
Other vulnerabilities in Stimulsoft Dashboard.JS
See all- CVE-2024-24396Medium
A Cross Site Scripting (XSS) vulnerability in Stimulsoft Dashboard.JS before version 2024.1.2 allows a remote attacker to execute arbitrary code via a crafted payload in the search bar component.
- CVE-2024-24397Medium
A Cross Site Scripting (XSS) vulnerability in Stimulsoft Dashboard.JS before version 2024.1.2 allows a remote attacker to execute arbitrary code via a crafted payload in the ReportName field.
Original NVD description (English source)
Directory Traversal vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitrary code via a crafted payload to the fileName parameter of the Save function.