Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

SO Planning Tool Allows Unauthenticated File Upload Leading to Code Execution

CVE-2024-27115 · published 2 years ago
Summary

The SO Planning online planning tool has a security issue that allows attackers to upload files to a publicly accessible folder without needing a password. This means that malicious code could be executed on the server, potentially causing harm. To fix this, update to version 1.52.02 or later.

What to do
  • Update soplanning soplanning to version 1.52.02 or later.
Affected software
VendorProductAffected versions
soplanning soplanning < 1.52.02
cpe:2.3:a:soplanning:soplanning:*:*:*:*:*:*:*:*
Original advisory text
A unauthenticated Remote Code Execution (RCE) vulnerability is found in the SO Planning online planning tool. With this vulnerability, an attacker can upload executable files that are moved to a pu...
A unauthenticated Remote Code Execution (RCE) vulnerability is found in the SO Planning online planning tool. With this vulnerability, an attacker can upload executable files that are moved to a publicly accessible folder before verifying any requirements. This leads to the possibility of execution of code on the underlying system when the file is triggered. The vulnerability has been remediated in version 1.52.02.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
10.0 Critical
Exploitation
5% chance of attack within 30 days
Type
CWE-434Unrestricted File Upload
Timeline
Published11 Sep 2024
Updated25 Oct 2026
First seen7 Mar 2026
Sources
CVE-2024-27115 · NVD
Track software like this
Free during beta