CVE-2024-29272
VvvebJs Arbitrary File Upload vulnerability
6.5
MEDIUM
CVSS 3.1
EPSS 9.4%
Description
Arbitrary File Upload vulnerability in VvvebJs before version 1.7.5, allows unauthenticated remote attackers to execute arbitrary code and obtain sensitive information via the sanitizeFileName parameter in save.php.
How to fix CVE-2024-29272
To remediate CVE-2024-29272, upgrade the affected package to a fixed version below.
- npm/vvvebJs—upgrade to 1.7.5 or later
Is CVE-2024-29272 being exploited?
Moderate — EPSS is 9.4%. Track this CVE but it's not at the top of the prioritisation list.
Affected packages (1)
- from 0, < 1.7.5
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 4.0 | — | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N |
| osv | CVSS 3.1 | MEDIUM6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |