CVE-2024-27311 MEDIUM

CVE-2024-27311: Arbitrary file writing

Vendor Manageengine

Product DDI Central

Weakness CWE-434 · Unrestricted file upload

Published July 17, 2024

Last update August 2, 2024

View on NVD All CVEs

CVSS base score

5.5/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction Required

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

What the vulnerability does

01Description

Zohocorp ManageEngine DDI Central versions 4001 and prior were vulnerable to directory traversal vulnerability which allows the user to upload new files to the server folder.

Key dates

02Disclosure timeline

July 17, 2024 CVE published

August 2, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-27311 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/434.html