CVE-2024-13191
Published: 08 January 2025
Summary
CVE-2024-13191 is a medium-severity Improper Access Control (CWE-284) vulnerability in Zerowdd Myblog. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 27.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2024-13191 is a vulnerability classified as critical in ZeroWdd myblog 1.0, affecting the upload function in the file src/main/java/com/wdd/myblog/controller/admin/uploadController.java. It enables unrestricted file upload through manipulation of the file argument and can be triggered remotely.
The vulnerability has a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), indicating that low-privileged remote attackers can exploit it with low complexity and no user interaction required. Successful exploitation allows limited impacts on confidentiality, integrity, and availability, and is associated with CWE-284 (Improper Access Control) and CWE-434 (Unrestricted Upload of File with Dangerous Type).
Advisories and further details are documented on VulDB (vuldb.com/?ctiid.290783, vuldb.com/?id.290783) and the project's GitHub repository (github.com/ZeroWdd/myblog/issues/3). The exploit has been publicly disclosed and may be used by attackers.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-51413
Vulnerability details
A vulnerability, which was classified as critical, has been found in ZeroWdd myblog 1.0. This issue affects the function upload of the file src/main/java/com/wdd/myblog/controller/admin/uploadController.java. The manipulation of the argument file leads to unrestricted upload. The attack may be initiated remotely.…
more
The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unrestricted remote file upload on public-facing web app directly enables exploitation of the application (T1190) and deployment of web shells for execution/persistence (T1505.003).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates unrestricted file upload by requiring validation of uploaded files for dangerous types and content, addressing CWE-434.
Enforces approved access authorizations and restrictions on the upload function, countering improper access control (CWE-284) in uploadController.java.
Restricts dangerous file inputs such as executable types in the manipulated file argument, preventing exploitation of the upload vulnerability.