CVE-2022-24984
Forms generated by JQueryForm.com before 2022-02-05 (if file-upload capability is enabled) allow remote unauthenticated attackers to upload executable files and achieve remote code execution.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.60%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Forms generated by JQueryForm.com before 2022-02-05 (if file-upload capability is enabled) allow remote unauthenticated attackers to upload executable files and achieve remote code execution. This occurs because file-extension checks occur on the client side, and because not all executable content (e.g., .phtml or .php.bak) is blocked.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 2.60% probability · 84th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-434
- Affected
- jqueryform/jqueryform
- Source
- cve@mitre.org
References
- https://JQueryForm.comVendor Advisory
- https://gist.github.com/pb-nsi/4d0a1ede76d4e97083b3435f820bf560Third Party Advisory
- https://www.nou-systems.com/cyber-securityThird Party Advisory
- https://JQueryForm.comVendor Advisory
- https://gist.github.com/pb-nsi/4d0a1ede76d4e97083b3435f820bf560Third Party Advisory
- https://www.nou-systems.com/cyber-securityThird Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.