tassos Convert Forms Component 1.0.0-4.4.7 on Joomla unrestricted upload

Summaryinfo

A vulnerability was found in tassos Convert Forms Component 1.0.0-4.4.7 on Joomla and classified as critical. Affected by this issue is some unknown functionality. Such manipulation leads to unrestricted upload. This vulnerability is uniquely identified as CVE-2024-40744. The attack can be launched remotely. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in tassos Convert Forms Component 1.0.0-4.4.7 on Joomla. It has been rated as critical. Affected by this issue is an unknown code. The manipulation with an unknown input leads to a unrestricted upload vulnerability. Using CWE to declare the problem leads to CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Unrestricted file upload via security bypass in Convert Forms component for Joomla in versions before 4.4.6.

This vulnerability is handled as CVE-2024-40744 since 07/09/2024. The exploitation is known to be easy. The attack may be launched remotely. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1608.002.

Upgrading to version 4.4.6 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Joomla Component

Vendor

• tassos

Name

• Convert Forms Component

Version

• 1.0.0-4.4.7

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion