CVE-2024-50427 - Vulnerability Details - OpenCVE

ReportizFlow

Unrestricted Upload of File with Dangerous Type vulnerability in Devsoft Baltic OÜ SurveyJS: Drag & Drop WordPress Form Builder.This issue affects SurveyJS: Drag & Drop WordPress Form Builder: from n/a through 1.9.136.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Devsoft Baltic	Surveyjs

No data.

No data.

References

Link	Providers
https://patchstack.com/database/vulnerability/surveyjs/wordpress-surveyjs-plugin-1-9-136-arbitrary-file-upload-vulnerability?_s_id=cve

History

Tue, 15 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.4118}`	epss `{'score': 0.4375}`

Tue, 29 Oct 2024 15:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Devsoft Baltic Devsoft Baltic surveyjs
CPEs		cpe:2.3:a:devsoft_baltic:surveyjs::::::::
Vendors & Products		Devsoft Baltic Devsoft Baltic surveyjs
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Tue, 29 Oct 2024 08:45:00 +0000

Type	Values Removed	Values Added
Description		Unrestricted Upload of File with Dangerous Type vulnerability in Devsoft Baltic OÜ SurveyJS: Drag & Drop WordPress Form Builder.This issue affects SurveyJS: Drag & Drop WordPress Form Builder: from n/a through 1.9.136.
Title		WordPress SurveyJS plugin <= 1.9.136 - Arbitrary File Upload vulnerability
Weaknesses		CWE-434
References		https://patchstack.com/database/vulnerability/surveyjs/wordpress-surveyjs-plugin-1-9-136-arbitrary-file-upload-vulnerability?_s_id=cve
Metrics		cvssV3_1 `{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: Patchstack

Published: 2024-10-29T08:31:25.351Z

Updated: 2024-10-29T15:08:17.688Z

Reserved: 2024-10-24T07:25:50.578Z

Link: CVE-2024-50427

Vulnrichment

Updated: 2024-10-29T14:39:03.028Z

NVD

Status : Awaiting Analysis

Published: 2024-10-29T09:15:10.710

Modified: 2024-10-29T14:34:04.427

Link: CVE-2024-50427

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-50427", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2024-10-24T07:25:50.578Z", "datePublished": "2024-10-29T08:31:25.351Z", "dateUpdated": "2024-10-29T15:08:17.688Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "surveyjs", "product": "SurveyJS: Drag & Drop WordPress Form Builder", "vendor": "Devsoft Baltic O\u00dc", "versions": [{"changes": [{"at": "1.12.4", "status": "unaffected"}], "lessThanOrEqual": "1.9.136", "status": "affected", "version": "n/a", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "stealthcopter (Patchstack Alliance)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Unrestricted Upload of File with Dangerous Type vulnerability in Devsoft Baltic O\u00dc SurveyJS: Drag & Drop WordPress Form Builder.<p>This issue affects SurveyJS: Drag & Drop WordPress Form Builder: from n/a through 1.9.136.</p>"}], "value": "Unrestricted Upload of File with Dangerous Type vulnerability in Devsoft Baltic O\u00dc SurveyJS: Drag & Drop WordPress Form Builder.This issue affects SurveyJS: Drag & Drop WordPress Form Builder: from n/a through 1.9.136."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2024-10-29T08:31:25.351Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/vulnerability/surveyjs/wordpress-surveyjs-plugin-1-9-136-arbitrary-file-upload-vulnerability?_s_id=cve"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Update to 1.12.4 or a higher version."}], "value": "Update to 1.12.4 or a higher version."}], "source": {"discovery": "EXTERNAL"}, "title": "WordPress SurveyJS plugin <= 1.9.136 - Arbitrary File Upload vulnerability", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"affected": [{"vendor": "devsoft_baltic", "product": "surveyjs", "cpes": ["cpe:2.3:a:devsoft_baltic:surveyjs:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.9.136", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-29T14:38:33.225529Z", "id": "CVE-2024-50427", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-29T15:08:17.688Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-50427", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-10-29T14:38:33.225529Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:devsoft_baltic:surveyjs:*:*:*:*:*:*:*:*"], "vendor": "devsoft_baltic", "product": "surveyjs", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.9.136"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-29T14:39:03.028Z"}}], "cna": {"title": "WordPress SurveyJS plugin <= 1.9.136 - Arbitrary File Upload vulnerability", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "stealthcopter (Patchstack Alliance)"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Devsoft Baltic O\u00dc", "product": "SurveyJS: Drag & Drop WordPress Form Builder", "versions": [{"status": "affected", "changes": [{"at": "1.12.4", "status": "unaffected"}], "version": "n/a", "versionType": "custom", "lessThanOrEqual": "1.9.136"}], "packageName": "surveyjs", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update to 1.12.4 or a higher version.", "supportingMedia": [{"type": "text/html", "value": "Update to 1.12.4 or a higher version.", "base64": false}]}], "references": [{"url": "https://patchstack.com/database/vulnerability/surveyjs/wordpress-surveyjs-plugin-1-9-136-arbitrary-file-upload-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Unrestricted Upload of File with Dangerous Type vulnerability in Devsoft Baltic O\u00dc SurveyJS: Drag & Drop WordPress Form Builder.This issue affects SurveyJS: Drag & Drop WordPress Form Builder: from n/a through 1.9.136.", "supportingMedia": [{"type": "text/html", "value": "Unrestricted Upload of File with Dangerous Type vulnerability in Devsoft Baltic O\u00dc SurveyJS: Drag & Drop WordPress Form Builder.<p>This issue affects SurveyJS: Drag & Drop WordPress Form Builder: from n/a through 1.9.136.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2024-10-29T08:31:25.351Z"}}}, "cveMetadata": {"cveId": "CVE-2024-50427", "state": "PUBLISHED", "dateUpdated": "2024-10-29T15:08:17.688Z", "dateReserved": "2024-10-24T07:25:50.578Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2024-10-29T08:31:25.351Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.1"}