CVE-2021-24347: falha em SP Project & Document Manager
SP Project & Document Manager <2 4.22 - Authenticated Shell Upload
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
30Vexday Risk Score
Corrija em breve. Ela tem exploit funcional público.
ssvc Attendepss 54%
da publicação à armano mesmo dia
Publicada no NVD14 de jun.
metasploit14 de jun.
The SP Project & Document Manager WordPress plugin before 4.22 allows users to upload files, however, the plugin attempts to prevent php and other similar files that could be executed on the server from being uploaded by checking the file extension. It was discovered that php files could still be uploaded by changing the file extension's case, for example, from "php" to "pHP".
Produtos afetados
Unknown · SP Project & Document ManagerCVEs relacionadas — SP Project & Document Manager
No mesmo produto, das mais perigosas para as menos.
CVE-2021-4225—SP Project & Document Manager < 4.24 - Subscriber+ Shell UploadEPSS 1.7%CVE-2022-1551—SP Project & Document Manager < 4.58 - Sensitive File DisclosureEPSS 1.0%CVE-2024-3749MEDIUMSP Project & Document Manager <= 4.71 - Subscriber+ File Download via IDOREPSS 0.5%CVE-2024-3748MEDIUMSP Project & Document Manager <= 4.71 - Data Update via IDOREPSS 0.4%