CVE-2024-46210 File upload in n/a
Attackers can execute arbitrary code by uploading a crafted file to the MediaPool module in Redaxo CMS.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-46210?
CVE-2024-46210 is a high-severity vulnerability in n/a, published on 10 Jan 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An arbitrary file upload vulnerability in the MediaPool module of Redaxo CMS v5.17.1 allows attackers to execute arbitrary code via uploading a crafted file.
Weakness: CWE-434
Which versions are affected by CVE-2024-46210?
It affects 1 product.
Products include Redaxo Redaxo.
How do I fix CVE-2024-46210?
No fix has been published for CVE-2024-46210 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-46210 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-46210 exists.
Other vulnerabilities in n/a
- CVE-2018-18200 SQL injection in n/a
- CVE-2018-17831 SQL injection in n/a
- CVE-2026-21857 Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read
- CVE-2006-2843 Code injection in n/a
- CVE-2006-2844 Multiple PHP remote file inclusion vulnerabilities in Redaxo 3.0 allow remote attackers to execute arbitrary PHP code via a URL in the REX[I
Sources
Also known as GHSA-cc53-v8jq-4w68.