What is CVE-2024-11984?

CVE-2024-11984 is a high-severity vulnerability in Sunnet Technology Co., Ltd. Corporate Training Management System, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 8.8/10. Published 2024-12-19.

How severe is CVE-2024-11984?

High severity. CVSS v3 base score is 8.8 out of 10.

Arbitrary file upload in Sunnet Technology Co., Ltd. Corporate Training Management System

CVE-2024-11984

A unrestricted upload of file with dangerous type vulnerability in epaper draft function in Corporate Training Management System before 10.13 allows remote authenticated users to bypass file upload restrictions and perform arbitrary system commands with SYSTEM privilege via a crafted ZIP file.

Vulnerability class: Unrestricted File Upload

EPSS: 0.007 (50.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Sunnet Technology Co., Ltd. Corporate Training Management System — versions 0

Weakness classification (CWE)

CWE-434 — Unrestricted Upload of File with Dangerous Type

References

ART@zuso.ai (third-party-advisory)

Frequently asked questions

What is CVE-2024-11984?: CVE-2024-11984 is a high-severity vulnerability in Sunnet Technology Co., Ltd. Corporate Training Management System, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 8.8/10. Published 2024-12-19.
How severe is CVE-2024-11984?: High severity. CVSS v3 base score is 8.8 out of 10.