CVE-2024-43033

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

JPress through 5.1.1 on Windows has an arbitrary file upload vulnerability that could cause arbitrary code execution via ::$DATA to AttachmentController, such as a .jsp::$DATA file to io.jpress.web.commons.controller.AttachmentController#upload. NOTE: this is unrelated to the attack vector for CVE-2024-32358.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-69

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
jpress	jpress	<= 5.1.1

References

https://cwe.mitre.org/data/definitions/69.htmlNot Applicable
https://github.com/JPressProjects/jpress/issues/188Exploit, Issue Tracking, Vendor Advisory
https://github.com/lazy-forever/CVE-Reference/tree/main/2024/43033Exploit, Third Party Advisory

Timeline

Published: Aug 22, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-430355.8Fonoster 0.5.5 before 0.6.1 allows ../ directory traversal to read arbitrary files via the /sounds/:file or /tts/:file VoiceServer endpoint.CVE-2024-43045.4A Cross-Site Scripting XSS vulnerability has been detected on GT3 Soluciones SWAL. This vulnerability consists in a reflected XSS in the Tit CVE-2024-430409.1Renwoxing Enterprise Intelligent Management System before v3.0 was discovered to contain a SQL injection vulnerability via the parid paramet CVE-2024-430429.8Pluck CMS 4.7.18 does not restrict failed login attempts, allowing attackers to execute a brute force attack.CVE-2024-430448.8Jenkins 2.470 and earlier, LTS 2.452.3 and earlier allows agent processes to read arbitrary files from the Jenkins controller file system by CVE-2024-430456.3Jenkins 2.470 and earlier, LTS 2.452.3 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/CVE-2024-430465.5There may be information disclosure during memory re-allocation in TZ Secure OS.CVE-2024-430477.8Memory corruption while maintaining memory maps of HLOS memory.CVE-2024-430487.8Memory corruption when invalid input is passed to invoke GPU Headroom API call.CVE-2024-430497.8Memory corruption while invoking IOCTL calls from user space to set generic private command inside WLAN driver.CVE-2024-43056.8The Post Grid Gutenberg Blocks and WordPress Blog Plugin WordPress plugin before 4.1.0 does not validate and escape some of its block optio CVE-2024-430507.8Memory corruption while invoking IOCTL calls from user space to issue factory test command inside WLAN driver.