CVE-2024-13144
Published: 06 January 2025
Summary
CVE-2024-13144 is a medium-severity Improper Access Control (CWE-284) vulnerability in Zhenfeng13 My-Blog. Its CVSS base score is 6.3 (Medium).
Operationally, ranked at the 22.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents exploitation by validating the content, type, and format of files uploaded via the editormd-image-file argument in the vulnerable uploadFileByEditomd function.
Restricts file uploads to the BlogController endpoint to only permitted types and formats, blocking unrestricted arbitrary file uploads.
Mandates remediation of the specific flaw in src/main/java/com/site/blog/my/core/controller/admin/BlogController.java through patching or code correction.
NVD Description
A vulnerability classified as critical has been found in zhenfeng13 My-Blog 1.0. Affected is the function uploadFileByEditomd of the file src/main/java/com/site/blog/my/core/controller/admin/BlogController.java. The manipulation of the argument editormd-image-file leads to unrestricted upload. It is possible to launch the attack remotely. The…
more
exploit has been disclosed to the public and may be used.
Deeper analysisAI
CVE-2024-13144 is a vulnerability classified as critical in zhenfeng13 My-Blog 1.0, affecting the uploadFileByEditomd function within the file src/main/java/com/site/blog/my/core/controller/admin/BlogController.java. The issue stems from manipulation of the editormd-image-file argument, enabling unrestricted file upload (CWE-284, CWE-434). It has a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and was published on 2025-01-06.
A remote attacker with low privileges, such as an authenticated user, can exploit this vulnerability over the network with low attack complexity and no user interaction. Exploitation allows arbitrary file uploads, potentially compromising confidentiality, integrity, and availability to a low degree. The exploit has been disclosed publicly and may be used.
Advisories and discussions on mitigation are available in GitHub issues such as https://github.com/ZHENFENG13/My-Blog/issues/140 and VulDB entries including https://vuldb.com/?id.290232.
Details
- CWE(s)