SB20240731212 - Multiple vulnerabilities in Gargaj wuhu

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Path traversal (CVE-ID: CVE-2024-6949)

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences. A remote user can send a specially crafted HTTP request and read arbitrary files on the system.

2) Arbitrary file upload (CVE-ID: CVE-2024-6948)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to insufficient validation of file during file upload in the file /slideeditor.php of the component Slide Editor. A remote user can upload a malicious file and execute it on the server.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• https://vuldb.com/?id.272071
• https://vuldb.com/?ctiid.272071
• https://vuldb.com/?submit.375146
• https://github.com/DeepMountains/Mirage/blob/main/CVE4-2.md
• https://vuldb.com/?id.272070
• https://vuldb.com/?ctiid.272070
• https://vuldb.com/?submit.374846
• https://github.com/DeepMountains/Mirage/blob/main/CVE4-1.md