CVE-2024-55371

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-55371
Wallos <= 2.38.2 has a file upload vulnerability in the restore backup function, which allows authenticated users to restore backups by uploading a ZIP file. The contents of the ZIP file are extracted on the server. This functionality enables an authenticated attacker (being an administrator is not required) to upload malicious files to the server. Once a web shell is installed, the attacker gains the ability to execute arbitrary commands.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://www.datafarm.co.th/blog/CVE-2024-55371-and-CVE-2024-55372-Malicious-File-Upload-to-RCE-in-Wallos-Application Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:wallosapp:wallos:*:*:*:*:*:*:*:*
History

03 Jun 2025, 15:00

Type Values Removed Values Added
First Time Wallosapp wallos
Wallosapp
References () https://www.datafarm.co.th/blog/CVE-2024-55371-and-CVE-2024-55372-Malicious-File-Upload-to-RCE-in-Wallos-Application - () https://www.datafarm.co.th/blog/CVE-2024-55371-and-CVE-2024-55372-Malicious-File-Upload-to-RCE-in-Wallos-Application - Exploit, Third Party Advisory
Summary
  • (es) Wallos &lt;= 2.38.2 presenta una vulnerabilidad de carga de archivos en la función de restauración de copias de seguridad. Esta vulnerabilidad permite a los usuarios autenticados restaurar copias de seguridad subiendo un archivo ZIP. El contenido del archivo ZIP se extrae en el servidor. Esta funcionalidad permite a un atacante autenticado (no es necesario ser administrador) subir archivos maliciosos al servidor. Una vez instalado un shell web, el atacante puede ejecutar comandos arbitrarios.
CPE cpe:2.3:a:wallosapp:wallos:*:*:*:*:*:*:*:*

17 Apr 2025, 14:15

Type Values Removed Values Added
CWE CWE-73
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8

16 Apr 2025, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-16 21:15

Updated : 2025-06-03 15:00

NVD link : CVE-2024-55371

Mitre link : CVE-2024-55371

CVE.ORG link : CVE-2024-55371

JSON object : View

Products Affected

wallosapp

  • wallos
CWE
CWE-73

External Control of File Name or Path