CVE Catalog
CVE-2024-24398
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk2.01%
79th percentile - higher than 79% of all known CVEs
Summary
A Directory Traversal vulnerability in Stimulsoft Dashboard.JS before version 2024.1.2 allows a remote attacker to execute arbitrary code via a crafted payload in the fileName parameter of the Save function.
Risk Assessment
An attacker can gain unauthorized access to the server's file system, potentially leading to full application compromise and data exfiltration.
Recommendation
Immediately update Stimulsoft Dashboard.JS to version 2024.1.2 or later, and restrict access to the Save function to trusted users.
Original NVD description (English source)
Directory Traversal vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitrary code via a crafted payload to the fileName parameter of the Save function.