Skip to main content

Tmall Demo CVE-2024-40553

MEDIUM
Unrestricted Upload of File with Dangerous Type (CWE-434)
2024-07-15 cve@mitre.org
File Upload Tmall Demo
4.9
CVSS 3.1 · Vendor: mitre
Share

Severity by source

Vendor (mitre) PRIMARY
4.9 MEDIUM
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

Lifecycle Timeline

1
CVE Published
Jul 15, 2024 - 16:15 cve.org
MEDIUM 4.9

DescriptionCVE.org

Tmall_demo v2024.07.03 was discovered to contain an arbitrary file upload via the component uploadUserHeadImage.

AnalysisAI

Tmall_demo v2024.07.03 was discovered to contain an arbitrary file upload via the component uploadUserHeadImage. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Unrestricted File Upload (CWE-434), which allows attackers to upload malicious files that can be executed on the server. Tmall_demo v2024.07.03 was discovered to contain an arbitrary file upload via the component uploadUserHeadImage. Affected products include: Project Team Tmall Demo.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate file types server-side, store uploads outside webroot, use random filenames, scan for malware.

More in Tmall Demo

View all
CVE-2025-1843 MEDIUM POC
5.3 Mar 03

A vulnerability, which was classified as critical, has been found in Mini-Tmall up to 20250211.java. Rated medium severi
CVE-2024-40554 HIGH
7.5 Jul 15

An access control issue in Tmall_demo v2024.07.03 allows attackers to obtain sensitive information. Rated high severity

CVE-2024-40560 HIGH
7.3 Jul 15

Tmall_demo before v2024.07.03 was discovered to contain a SQL injection vulnerability. Rated high severity (CVSS 7.3), t
CVE-2024-8568 MEDIUM
5.3 Sep 08

A vulnerability, which was classified as critical, was found in Mini-Tmall up to 20240901. Rated medium severity (CVSS 5
CVE-2024-40555 MEDIUM
5.3 Jul 15

Tmall_demo v2024.07.03 was discovered to contain an arbitrary file upload vulnerability. Rated medium severity (CVSS 5.3
CVE-2025-5136 MEDIUM POC
6.3 May 25

A vulnerability, which was classified as problematic, was found in Tmall Demo up to 20250505. Rated medium severity (CVS
CVE-2025-5135 MEDIUM POC
4.8 May 24

A vulnerability, which was classified as problematic, has been found in Tmall Demo up to 20250505. Rated medium severity
CVE-2025-5134 MEDIUM POC
5.1 May 24

A vulnerability classified as problematic was found in Tmall Demo up to 20250505. Rated medium severity (CVSS 5.1), this
CVE-2025-5133 MEDIUM POC
5.3 May 24

A vulnerability classified as problematic has been found in Tmall Demo up to 20250505. Rated medium severity (CVSS 5.3),
CVE-2025-5132 MEDIUM POC
5.3 May 24

A vulnerability was found in Tmall Demo up to 20250505. Rated medium severity (CVSS 5.3), this vulnerability is remotely
CVE-2025-5131 MEDIUM POC
5.1 May 24

A vulnerability was found in Tmall Demo up to 20250505. Rated medium severity (CVSS 5.1), this vulnerability is remotely
CVE-2025-5130 MEDIUM POC
5.1 May 24

A vulnerability was found in Tmall Demo up to 20250505. Rated medium severity (CVSS 5.1), this vulnerability is remotely

Same weakness CWE-434 – Unrestricted Upload of File with Dangerous Type

View all
CVE-2016-3088 CRITICAL POC
9.8
CVE-2021-31207 MEDIUM POC
6.6
CVE-2017-12617 HIGH POC
8.1
CVE-2017-11357 CRITICAL POC
9.8
CVE-2017-12615 HIGH POC
8.1
CVE-2024-5084 CRITICAL POC
9.8
CVE-2020-36847 CRITICAL POC
9.8
CVE-2017-6090 HIGH POC
8.8

Same technique File Upload

View all
CVE-2016-3088 CRITICAL POC
9.8
CVE-2017-12617 HIGH POC
8.1
CVE-2017-11357 CRITICAL POC
9.8
CVE-2017-12615 HIGH POC
8.1
CVE-2024-5084 CRITICAL POC
9.8
CVE-2016-6600 CRITICAL POC
9.8
CVE-2017-6090 HIGH POC
8.8
CVE-2015-8249 CRITICAL POC
9.8

Share

CVE-2024-40553 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy