« Volver al listado

CVE-2024-35595

Estado: AplazadaMedia (6.1)—

Una vulnerabilidad de carga de archivos arbitraria en la función Vista previa de archivos de Xintongda OA v2023.12.30.1 permite a los atacantes ejecutar código arbitrario cargando un archivo PDF manipulado.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Xintongda — OAAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-35595",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-35595",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-06-06T15:43:26.799446Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:xtdoa:xintongda_oa:2023.12.30.1:*:*:*:*:*:*:*"
          ],
          "vendor": "xtdoa",
          "product": "xintongda_oa",
          "versions": [
            {
              "status": "affected",
              "version": "2023.12.30.1"
            }
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2024-05-24T14:15:17.487",
  "references": [
    {
      "url": "https://github.com/Joying-C/Cross-site-scripting-vulnerability/blob/main/Xintongda-OA_Cross_site%20_scripting%20_vulnerability/Xintongda-OA_Cross_site%20_scripting%20_vulnerability.pdf",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/Joying-C/Cross-site-scripting-vulnerability/tree/main/Xintongda-OA_Cross_site%20_scripting%20_vulnerability",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/Joying-C/Cross-site-scripting-vulnerability/blob/main/Xintongda-OA_Cross_site%20_scripting%20_vulnerability/Xintongda-OA_Cross_site%20_scripting%20_vulnerability.pdf",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/Joying-C/Cross-site-scripting-vulnerability/tree/main/Xintongda-OA_Cross_site%20_scripting%20_vulnerability",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An arbitrary file upload vulnerability in the File Preview function of Xintongda OA v2023.12.30.1 allows attackers to execute arbitrary code via uploading a crafted PDF file."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de carga de archivos arbitraria en la función Vista previa de archivos de Xintongda OA v2023.12.30.1 permite a los atacantes ejecutar código arbitrario cargando un archivo PDF manipulado."
    }
  ],
  "lastModified": "2026-06-17T07:35:04.510",
  "sourceIdentifier": "cve@mitre.org"
}