CVE-2024-13133
Published: 05 January 2025
Summary
CVE-2024-13133 is a medium-severity Improper Access Control (CWE-284) vulnerability in Zerowdd Studentmanager. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 27.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-13133 is a critical vulnerability in ZeroWdd studentmanager version 1.0, affecting the addStudent and editStudent functions within the file src/main/java/com/wdd/studentmanager/controller/StudentController.java. The flaw allows unrestricted file upload through manipulation of the 'file' argument, enabling attackers to upload arbitrary files remotely. It is associated with CWE-284 (Improper Access Control) and CWE-434 (Unrestricted Upload of File with Dangerous Type), and carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
An attacker with low privileges (PR:L) can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation grants limited impacts: low confidentiality (C:L) via potential access to uploaded files, low integrity (I:L) through malicious file modifications, and low availability (A:L) disruption. The exploit has been publicly disclosed, increasing the risk of remote initiation.
Advisories referenced in GitHub issues #16 (including comment #2755347097) and VulDB entries (ctiid.290207 and id.290207) detail the vulnerability but do not specify patches or mitigations in the available information. Security practitioners should review these sources for updates on remediation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-51366
Vulnerability details
A vulnerability, which was classified as critical, has been found in ZeroWdd studentmanager 1.0. This issue affects the function addStudent/editStudent of the file src/main/Java/com/wdd/studentmanager/controller/StudentController. java. The manipulation of the argument file leads to unrestricted upload. The attack may be initiated…
more
remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unrestricted file upload in public-facing web app directly enables remote exploitation (T1190), arbitrary file ingress (T1105), and web shell deployment (T1505.003).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely identification, reporting, and remediation of the critical unrestricted file upload flaw in StudentController.java, eliminating the vulnerability.
Validates the manipulated 'file' argument in addStudent/editStudent functions to reject dangerous file types and contents, preventing unrestricted uploads.
Restricts classes of file inputs to safe types only, blocking arbitrary file uploads via the vulnerable controller endpoints.