{"id":"CVE-2024-8304","state":"PUBLISHED","title":"jpress Template Module edit path traversal","description":"A vulnerability has been found in jpress up to 5.1.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/template/edit of the component Template Module Handler. The manipulation leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.","publishedAt":"2024-08-29T14:31:05.547Z","updatedAt":"2024-08-29T15:43:47.485Z","severity":{"score":5.1,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","source":"VulDB"},"assigner":"VulDB","products":["n/a jpress"],"affected":[{"vendor":"n/a","product":"jpress","versions":[{"version":"5.1.0","status":"affected"},{"version":"5.1.1","status":"affected"}],"modules":["Template Module Handler"]}],"references":["https://vuldb.com/?id.276079","https://vuldb.com/?ctiid.276079","https://vuldb.com/?submit.396425","https://github.com/JPressProjects/jpress/issues/189"],"weaknesses":["CWE-22"],"ingestedAt":"2026-10-29T20:08:20.985Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/8xxx/CVE-2024-8304.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-8304","state":"PUBLISHED","datePublished":"2024-08-29T14:31:05.547Z","dateUpdated":"2024-08-29T15:43:47.485Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2024-08-29T07:31:56.984Z"},"containers":{"cna":{"title":"jpress Template Module edit path traversal","descriptions":[{"lang":"en","value":"A vulnerability has been found in jpress up to 5.1.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/template/edit of the component Template Module Handler. The manipulation leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used."},{"lang":"de","value":"In jpress bis 5.1.1 wurde eine Schwachstelle gefunden. Sie wurde als kritisch eingestuft. Hierbei betrifft es unbekannten Programmcode der Datei /admin/template/edit der Komponente Template Module Handler. Dank Manipulation mit unbekannten Daten kann eine path traversal-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff über das Netzwerk. Der Exploit steht zur öffentlichen Verfügung."}],"affected":[{"vendor":"n/a","product":"jpress","versions":[{"version":"5.1.0","status":"affected"},{"version":"5.1.1","status":"affected"}],"modules":["Template Module Handler"]}],"references":[{"url":"https://vuldb.com/?id.276079","name":"VDB-276079 | jpress Template Module edit path traversal","tags":["vdb-entry"]},{"url":"https://vuldb.com/?ctiid.276079","name":"VDB-276079 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.396425","name":"Submit #396425 | https://github.com/JPressProjects jpress ≤v5.1.1 path","tags":["third-party-advisory"]},{"url":"https://github.com/JPressProjects/jpress/issues/189","tags":["exploit","issue-tracking"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.1,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":4.7,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":4.7,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":5.8,"vectorString":"AV:N/AC:L/Au:M/C:P/I:P/A:P"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-22","type":"CWE","lang":"en","description":"CWE-22 Path Traversal"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2024-08-29T14:31:05.547Z"},"timeline":[{"time":"2024-08-29T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2024-08-29T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2024-08-29T09:37:04.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"microvorld (VulDB User)","type":"reporter"}]},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"jpress","product":"jpress","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThanOrEqual":"5.1.1","versionType":"custom"}],"cpes":["cpe:2.3:a:jpress:jpress:*:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-08-29T15:42:29.094845Z","id":"CVE-2024-8304","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-08-29T15:43:47.485Z"}}]}}}