CVE-2024-35595

MEDIUM

Xintongda OA v2023.12.30.1 - Remote Code Execution via File Preview PDF Upload

Title source: llm

Description

An arbitrary file upload vulnerability in the File Preview function of Xintongda OA v2023.12.30.1 allows attackers to execute arbitrary code via uploading a crafted PDF file.

References (2)

Core 2

Core References

Various Sources

https://github.com/Joying-C/Cross-site-scripting-vulnerability/blob/main/Xintongda-OA_Cross_site%20_scripting%20_vulnerability/Xintongda-OA_Cross_site%20_scripting%20_vulnerability.pdf

Various Sources

https://github.com/Joying-C/Cross-site-scripting-vulnerability/tree/main/Xintongda-OA_Cross_site%20_scripting%20_vulnerability

Scores

CVSS v3 6.1

EPSS 0.0036

EPSS Percentile 28.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-79

Status published

Published May 24, 2024

Tracked Since Feb 18, 2026