{"id":"CVE-2024-43033","aliases":["EUVD-2024-40021","GHSA-hpf9-cfgc-pw67"],"status":"published","title":"JPress through 5.1.1 on Windows has an arbitrary file upload vulnerability that could cause...","description":"JPress through 5.1.1 on Windows has an arbitrary file upload vulnerability that could cause arbitrary code execution via ::$DATA to AttachmentController, such as a .jsp::$DATA file to io.jpress.web.commons.controller.AttachmentController#upload. NOTE: this is unrelated to the attack vector for CVE-2024-32358.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.0098,"percentile":0.62512,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-69"],"published":"2024-08-22T00:00:00Z","modified":"2026-10-28T02:30:41Z","products":[{"vendor":"jpress","product":"jpress"}],"references":[{"url":"https://github.com/JPressProjects/jpress/issues/188","tags":["Exploit","Issue Tracking","Vendor Advisory","report"]},{"url":"https://cwe.mitre.org/data/definitions/69.html","tags":["Not Applicable","web"]},{"url":"https://github.com/lazy-forever/CVE-Reference/tree/main/2024/43033","tags":["Exploit","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43033","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-hpf9-cfgc-pw67"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43033.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-43033","description":"JPress through 5.1.1 on Windows has an arbitrary file upload vulnerability that could cause arbitrary code execution via ::$DATA to AttachmentController, such as a .jsp::$DATA file to io.jpress.web.commons.controller.AttachmentController#upload. NOTE: this is unrelated to the attack vector for CVE-2024-32358.","status":"published","published":"2024-08-22T00:00:00Z","modified":"2024-08-23T15:24:23.081Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-69"],"updated_at":"2026-11-02T14:33:58.839967Z"}],"euvd":[{"id":"EUVD-2024-40021","description":"JPress through 5.1.1 on Windows has an arbitrary file upload vulnerability that could cause arbitrary code execution via ::$DATA to AttachmentController, such as a .jsp::$DATA file to io.jpress.web.commons.controller.AttachmentController#upload. NOTE: this is unrelated to the attack vector for CVE-2024-32358.","status":"published","published":"2024-08-22T00:00:00Z","modified":"2024-08-23T15:24:23Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:56:12.238043Z"}],"ghsa":[{"id":"GHSA-hpf9-cfgc-pw67","title":"JPress through 5.1.1 on Windows has an arbitrary file upload vulnerability that could cause...","description":"JPress through 5.1.1 on Windows has an arbitrary file upload vulnerability that could cause arbitrary code execution via ::$DATA to AttachmentController, such as a .jsp::$DATA file to io.jpress.web.commons.controller.AttachmentController#upload. NOTE: this is unrelated to the attack vector for CVE-2024-32358.","status":"published","published":"2024-08-22T03:31:33Z","modified":"2024-08-22T18:31:22Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-69"],"updated_at":"2026-11-02T14:58:02.951823Z"}],"nvd":[{"id":"CVE-2024-43033","description":"JPress through 5.1.1 on Windows has an arbitrary file upload vulnerability that could cause arbitrary code execution via ::$DATA to AttachmentController, such as a .jsp::$DATA file to io.jpress.web.commons.controller.AttachmentController#upload. NOTE: this is unrelated to the attack vector for CVE-2024-32358.","status":"published","published":"2024-08-22T01:15:03.54Z","modified":"2026-06-17T07:50:17.45Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-69"],"updated_at":"2026-11-02T14:10:19.870727Z"}],"osv":[{"id":"CVE-2024-43033","description":"JPress through 5.1.1 on Windows has an arbitrary file upload vulnerability that could cause arbitrary code execution via ::$DATA to AttachmentController, such as a .jsp::$DATA file to io.jpress.web.commons.controller.AttachmentController#upload. NOTE: this is unrelated to the attack vector for CVE-2024-32358.","status":"published","published":"2024-08-22T00:00:00Z","modified":"2026-10-28T02:30:41.609335829Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:42.322107Z"}]}}