Path Traversal in Fujian Apex Software Co. Ltd. Livebos
CVE-2024-13981
LiveBOS, an object-oriented business architecture middleware suite developed by Apex Software Co., Ltd., contains an arbitrary file upload vulnerability in its UploadFile.do;.js.jsp endpoint. This flaw affects the LiveBOS Server component and allows unauthenticated remote attackers to upload crafted files outside the intended directory structure via path traversal in the filename parameter. Successful exploitation may lead to remote code execution on the server, enabling full system compromise. The vulnerability is presumed to affect builds released prior to August 2024 and is said to be remediated in newer versions of the product, though the exact affected range remains undefined. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-08-23 UTC.
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
EPSS exploit prediction
EPSS: 0.009 (58.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 58th percentile — 58.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.009 · newest: 0.009 · change: 0.000
Affected products
- Fujian Apex Software Co. Ltd. Livebos — versions 0
Weakness classification (CWE)
References
- cn-sec.com/archives/3041179.html (technical-description, exploit)
- axsec.blog.csdn.net/article/details/140847466 (technical-description, exploit)
- github.com/folio2008/POC_wy876/blob/main/LiveBOS/灵动业务架构平台(LiveBOS)系统UploadFile… (exploit)
- blog.csdn.net/weixin_53009585/article/details/140853891 (technical-description, exploit)
- blog.csdn.net/jingke666/article/details/140855251 (technical-description, exploit)
- www.apexsoft.com.cn/platform/index.html (product)
- www.vulncheck.com/advisories/livebos-uploadfile-arbitrary-file-upload (third-party-advisory)