CVE-2024-58298
CriticalSummary
Compuware iStrobe Web 20.13 contains a pre-authentication remote code execution vulnerability that allows unauthenticated attackers to upload malicious JSP files through a path traversal in the file upload form. Attackers can exploit the 'fileName' parameter to upload a web shell and execute arbitrary commands by sending POST requests to the uploaded JSP endpoint.
Risk Assessment
An unauthenticated attacker can gain full control over the server, leading to complete compromise of the system and data.
Recommendation
It is recommended to immediately update Compuware iStrobe Web to the latest version and implement protections against path traversal and unauthorized file uploads.
Original NVD description (English source)
Compuware iStrobe Web 20.13 contains a pre-authentication remote code execution vulnerability that allows unauthenticated attackers to upload malicious JSP files through a path traversal in the file upload form. Attackers can exploit the 'fileName' parameter to upload a web shell and execute arbitrary commands by sending POST requests to the uploaded JSP endpoint.