CVE-2024-4825 is a critical arbitrary file upload vulnerability affecting Agentejo Cockpit CMS v0.5.5. An unauthenticated attacker can exploit this flaw by sending a POST request to the '/media/api' endpoint, allowing them to upload malicious files to the server. This remote code execution capability results in a CVSS score of 9.8 (CRITICAL), indicating complete compromise of confidentiality, integrity, and availability. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion with 10 mentions, suggesting awareness among security researchers.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
0.5.5CPE matchmatch criteria | cpe:2.3:a:agentejo:cockpit:0.5.5:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.