
Cloud Vulnerability DB
A community-led vulnerabilities database
An issue was discovered in Znuny and Znuny LTS versions 6.0.31 through 6.5.7 and Znuny versions 7.0.1 through 7.0.16. The vulnerability allows a logged-in user to upload a file via a manipulated AJAX Request to an arbitrary writable location by traversing paths. This vulnerability was discovered and reported by Martino Spagnuolo and was assigned CVE-2024-32491 (Znuny Advisory).
The vulnerability is classified as a Code Injection vulnerability (CWE-94) with a CVSS v3.1 Base Score of 9.8 (CRITICAL) and vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The issue allows path traversal through manipulated AJAX requests, potentially leading to arbitrary code execution if the upload location is publicly accessible through the web server (NVD).
If exploited, this vulnerability could lead to arbitrary code execution on the affected system when the uploaded file location is publicly accessible through the web server. This presents a critical security risk as it could allow attackers to execute malicious code and potentially take control of the affected system (Znuny Advisory).
The vulnerability requires an authenticated user to exploit, but has low attack complexity. The attack vector is network-accessible, and no user interaction is required beyond the initial authentication (NVD).
Users should upgrade to the latest version of Znuny that addresses this vulnerability. The issue has been fixed in versions newer than 6.5.7 for Znuny LTS and versions newer than 7.0.16 for Znuny (Znuny Advisory).
Source: This report was generated using AI
Free Vulnerability Assessment
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
"We know that if Wiz identifies something as critical, it actually is."