CVE-2024-58298 Compuware iStrobe Web 20.13 Pre-Auth Remote Code Execution via File Upload
Unauthenticated attackers can upload malicious JSP files via path traversal to execute arbitrary commands on Compuware iStrobe Web.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-58298?
CVE-2024-58298 is a critical vulnerability in BMC Software Compuware iStrobe Web, published on 11 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Compuware iStrobe Web 20.13 contains a pre-authentication remote code execution vulnerability that allows unauthenticated attackers to upload malicious JSP files through a path traversal in the file upload form. Attackers can exploit the 'fileName' parameter to upload a web shell and execute arbitrary commands by sending POST requests to the uploaded JSP endpoint.
Weakness: CWE-434
Which versions are affected by CVE-2024-58298?
How do I fix CVE-2024-58298?
No fix has been published for CVE-2024-58298 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-58298 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-58298 exists.
Sources
Also known as GHSA-xfg6-cf6g-5887.