What is CVE-2024-28048?

CVE-2024-28048 is a critical-severity vulnerability in Fortunefield Ffbull, classified under OS Command Injection. CVSS score: 9.8/10. Published 2024-03-26.

How severe is CVE-2024-28048?

Critical severity. CVSS v3 base score is 9.8 out of 10.

RCE in Fortunefield Ffbull

CVE-2024-28048

OS command injection vulnerability exists in ffBull ver.4.11, which may allow a remote unauthenticated attacker to execute an arbitrary OS command with the privilege of the running web server. Note that the developer was unreachable, therefore, users should consider stop using ffBull ver.4.11.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.013 (67.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Fortunefield Ffbull — versions ver.4.11

Weakness classification (CWE)

CWE-78 — OS Command Injection

References

vultures@jpcert.or.jp

Frequently asked questions

What is CVE-2024-28048?: CVE-2024-28048 is a critical-severity vulnerability in Fortunefield Ffbull, classified under OS Command Injection. CVSS score: 9.8/10. Published 2024-03-26.
How severe is CVE-2024-28048?: Critical severity. CVSS v3 base score is 9.8 out of 10.