CVE-2024-13191
Published: 08 January 2025
Summary
CVE-2024-13191 is a medium-severity Improper Access Control (CWE-284) vulnerability in Zerowdd Myblog. Its CVSS base score is 6.3 (Medium).
Operationally, ranked at the 22.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates unrestricted file upload by requiring validation of uploaded files for dangerous types and content, addressing CWE-434.
Enforces approved access authorizations and restrictions on the upload function, countering improper access control (CWE-284) in uploadController.java.
Restricts dangerous file inputs such as executable types in the manipulated file argument, preventing exploitation of the upload vulnerability.
NVD Description
A vulnerability, which was classified as critical, has been found in ZeroWdd myblog 1.0. This issue affects the function upload of the file src/main/java/com/wdd/myblog/controller/admin/uploadController.java. The manipulation of the argument file leads to unrestricted upload. The attack may be initiated remotely.…
more
The exploit has been disclosed to the public and may be used.
Deeper analysisAI
CVE-2024-13191 is a vulnerability classified as critical in ZeroWdd myblog 1.0, affecting the upload function in the file src/main/java/com/wdd/myblog/controller/admin/uploadController.java. It enables unrestricted file upload through manipulation of the file argument and can be triggered remotely.
The vulnerability has a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), indicating that low-privileged remote attackers can exploit it with low complexity and no user interaction required. Successful exploitation allows limited impacts on confidentiality, integrity, and availability, and is associated with CWE-284 (Improper Access Control) and CWE-434 (Unrestricted Upload of File with Dangerous Type).
Advisories and further details are documented on VulDB (vuldb.com/?ctiid.290783, vuldb.com/?id.290783) and the project's GitHub repository (github.com/ZeroWdd/myblog/issues/3). The exploit has been publicly disclosed and may be used by attackers.
Details
- CWE(s)