CVE-2024-43033: jpress — Exploit & Fix

Description

JPress through 5.1.1 on Windows has an arbitrary file upload vulnerability that could cause arbitrary code execution via ::$DATA to AttachmentController, such as a .jsp::$DATA file to io.jpress.web.commons.controller.AttachmentController#upload. NOTE: this is unrelated to the attack vector for CVE-2024-32358.

Is your site exposed to CVE-2024-43033?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

8.8

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness Type (CWE)

CWE-69 CWE-69

Affected Products

Vendor	Product	Versions
jpress	jpress	< 5.1.1
microsoft	windows	All

References

Advisories & Patches

https://github.com/JPressProjects/jpress/issues/188

Exploits

https://github.com/JPressProjects/jpress/issues/188 https://github.com/lazy-forever/CVE-Reference/tree/main/2024/43033

Other References

https://cwe.mitre.org/data/definitions/69.html

Frequently Asked Questions

What is CVE-2024-43033? +

JPress through 5.1.1 on Windows has an arbitrary file upload vulnerability that could cause arbitrary code execution via ::$DATA to AttachmentController, such as a .jsp::$DATA file to io.jpress.web.commons.controller.AttachmentController#upload. NOTE: this is unrelated to the attack vector for CVE-2024-32358. It has a CVSS v3.1 base score of 8.8 (HIGH).

How severe is CVE-2024-43033? +

CVE-2024-43033 has a CVSS v3.1 score of 8.8 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

What products are affected by CVE-2024-43033? +

CVE-2024-43033 affects products from jpress, microsoft, specifically: jpress, windows. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-43033? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-3941 5.4

Improper Handling of Windows ::DATA Alternate Data Stream vulnerability in Tridium Niagara Framework on Windows, Tridium Niagara Enterprise Security on …

CVE-2024-50919 9.8

Jpress until v5.1.1 has arbitrary file uploads on the windows platform, and the construction of non-standard file formats such as …

CVE-2024-46468 7.5

A Server-Side Request Forgery (SSRF) vulnerability exists in the jpress <= v5.1.1, which can be exploited by an attacker to …

CVE-2024-32358 7.5

An issue in Jpress v.5.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the custom …

CVE-2024-8304 4.7

A vulnerability has been found in jpress up to 5.1.1 and classified as critical. Affected by this vulnerability is an …

CVE-2024-11971 3.5

A vulnerability classified as problematic was found in Guizhou Xiaoma Technology jpress 5.1.2. Affected by this vulnerability is an unknown …

CVE-2024-43033