CVE-2024-48069

The vulnerability (CWE-362) consists of a time-of-check-time-of-use race condition in the access control mechanism during file upload. An attacker can win this race and upload a malicious file before the system has time to verify its admissibility or apply appropriate security restrictions. As a result, the file reaches the server bypassing normal security measures, which opens the door to further privilege escalation.

An attacker can upload malicious files (e.g., webshell) to the server and gain full control over its permissions, which in practice means the ability to execute arbitrary commands, steal data, and perform lateral movement within the network.

Patches available from the vendor should be applied according to the references. It is also recommended to restrict network access to the application interface only to trusted IP addresses and to monitor file upload attempts on the server.

Weaver E-Cology — versions indicated in vendor references