CVE-2024-30248

CVSS V2 None CVSS V3 None

Description

Piccolo Admin is an admin interface/content management system for Python, built on top of Piccolo. Piccolo's admin panel allows media files to be uploaded. As a default, SVG is an allowed file type for upload. An attacker can upload an SVG which when loaded can allow arbitrary access to the admin page. This vulnerability was patched in version 1.3.2.

Overview

CVE ID
CVE-2024-30248

Assigner
GitHub_M

Vulnerability Status
PUBLISHED

Published Version
2024-04-02T14:55:17.483Z

Last Modified Date
2024-06-20T15:31:42.896Z

Weakness Enumerations

CWE	URL
CWE-79	http://cwe.mitre.org/data/definitions/79.html

References

Reference URL	Reference Tags
https://github.com/piccolo-orm/piccolo_admin/security/advisories/GHSA-pmww-v6c9-7p83	x_refsource_CONFIRM
https://github.com/piccolo-orm/piccolo_admin/commit/c419575c2467959d906154084d305648eb2b8faf	x_refsource_MISC

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2024-30248
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-30248

History

Created	Old Value	New Value	Data Type	Notes
2024-06-26 11:30:09				Added to TrackCVE