Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-52771: DedeBIZ v6.3.0 Allows Unauthenticated File Deletion

CVE-2024-52771 · published 1 year ago

Summary

DedeBIZ version 6.3.0 has a security weakness that allows someone to delete any file on the server without a password. This could lead to sensitive data being lost or corrupted. Update to the latest version of DedeBIZ to fix this vulnerability.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
dedebiz	dedebiz	6.3.0 `cpe:2.3:a:dedebiz:dedebiz:6.3.0:::::::*`

Original advisory text

DedeBIZ v6.3.0 was discovered to contain an arbitrary file deletion vulnerability via the component /admin/file_manage_view.

References

https://co-a1natas.feishu.cn/docx/Zsd9dnGUvoBW6tx0G5fcVx6vnBb Exploit Third Party Advisory
https://github.com/DedeBIZ/DedeV6/ Product

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

9.1 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-22Path Traversal

Timeline

Published20 Nov 2024

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2024-52771 · NVD

Track software like this

Free during beta