Continew Admin
Monthly
Authorization bypass in ContiNew Admin through 4.1.0 allows any authenticated user to delete other users' personal messages and announcements by submitting arbitrary identifiers in the IdsReq parameter to the personal message delete endpoint in UserMessageController. Because the pre-patch MessageServiceImpl.delete() called baseMapper.deleteByIds(ids) without verifying ownership, the attacker can remove any message row and also purge all recipients' read receipts for those messages. Impact is integrity-only (CVSS 3.1 assessed: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N; vendor-published CVSS 4.0 score 7.1, VI:H), requiring only a valid low-privileged account with no admin role and no user interaction; no public exploit code was identified at time of analysis.
Unrestricted file upload in ContiNew Admin through v4.1.0 allows authenticated users to bypass server-side validation entirely on multipart upload endpoints, storing files with arbitrary extensions in the backend storage. The flaw stems from missing permission checks and the absence of any file-type allowlist in MultipartUploadController.java, meaning a low-privileged account holder can upload content such as server-side scripts. Uploaded files are then accessible via web server URLs, creating a direct path to webshell deployment or persistent malicious content delivery. No public exploit or CISA KEV listing is confirmed at time of analysis.
ContiNew Admin up to version 4.2.0 contains a server-side request forgery vulnerability in its Storage Management Module that allows remote attackers to manipulate URI creation functions with high privileges. Public exploit code exists for this vulnerability, and no patch is currently available from the vendor despite early disclosure notification.
A vulnerability has been found in ContiNew Admin up to 3.6.0 and classified as problematic. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as problematic, was found in ContiNew Admin up to 3.6.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in ContiNew Admin 3.2.0 and classified as critical. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Authorization bypass in ContiNew Admin through 4.1.0 allows any authenticated user to delete other users' personal messages and announcements by submitting arbitrary identifiers in the IdsReq parameter to the personal message delete endpoint in UserMessageController. Because the pre-patch MessageServiceImpl.delete() called baseMapper.deleteByIds(ids) without verifying ownership, the attacker can remove any message row and also purge all recipients' read receipts for those messages. Impact is integrity-only (CVSS 3.1 assessed: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N; vendor-published CVSS 4.0 score 7.1, VI:H), requiring only a valid low-privileged account with no admin role and no user interaction; no public exploit code was identified at time of analysis.
Unrestricted file upload in ContiNew Admin through v4.1.0 allows authenticated users to bypass server-side validation entirely on multipart upload endpoints, storing files with arbitrary extensions in the backend storage. The flaw stems from missing permission checks and the absence of any file-type allowlist in MultipartUploadController.java, meaning a low-privileged account holder can upload content such as server-side scripts. Uploaded files are then accessible via web server URLs, creating a direct path to webshell deployment or persistent malicious content delivery. No public exploit or CISA KEV listing is confirmed at time of analysis.
ContiNew Admin up to version 4.2.0 contains a server-side request forgery vulnerability in its Storage Management Module that allows remote attackers to manipulate URI creation functions with high privileges. Public exploit code exists for this vulnerability, and no patch is currently available from the vendor despite early disclosure notification.
A vulnerability has been found in ContiNew Admin up to 3.6.0 and classified as problematic. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as problematic, was found in ContiNew Admin up to 3.6.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in ContiNew Admin 3.2.0 and classified as critical. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.