Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-13022: Taisan Tarzan-CMS 1.0.0 Allows Unrestricted File Upload

CVE-2024-13022 · published 1 year ago

Summary

A critical security flaw in Taisan Tarzan-CMS 1.0.0 allows attackers to upload any file without restrictions, which can lead to unauthorized access and potential data breaches. This affects the Article Management feature. To protect your system, update to the latest version of Taisan Tarzan-CMS as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
taisan	tarzan-cms	1.0.0 `cpe:2.3:a:taisan:tarzan-cms:1.0.0:::::::*`

Original advisory text

A vulnerability, which was classified as critical, was found in taisan tarzan-cms 1.0.0. This affects the function UploadResponse of the file src/main/java/com/tarzan/cms/modules/admin/controller/common/UploadController.java of the component Article Management. The manipulation of the argument file leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

References

https://gitee.com/taisan/tarzan-cms/issues/IBCUPG Exploit Issue Tracking
https://vuldb.com/?ctiid.289713 Permissions Required VDB Entry
https://vuldb.com/?id.289713 Third Party Advisory VDB Entry
https://vuldb.com/?submit.467471 Third Party Advisory VDB Entry

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

5.3 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-284Improper Access Control

CWE-434Unrestricted File Upload

Timeline

Published29 Dec 2024

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2024-13022 · NVD

Track software like this

Free during beta