Jpress vulnerabilities
We track 4 vulnerabilities in Jpress products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on November 18, 2024.
Latest Jpress vulnerabilities
- 9.8 Critical severity
jpress: Improper Control of Generation of Code
Jpress until v5.1.1 has arbitrary file uploads on the windows platform, and the construction of non-standard file formats such as .jsp. can lead to arbitrary command execution
- 7.5 High severity
jpress: Server-Side Request Forgery
A Server-Side Request Forgery (SSRF) vulnerability exists in the jpress <= v5.1.1, which can be exploited by an attacker to obtain sensitive information, resulting in an information disclosure.
- 8.8 High severity
jpress: Improper Handling of Windows ::DATA Alternate Data Stream
JPress through 5.1.1 on Windows has an arbitrary file upload vulnerability that could cause arbitrary code execution via ::$DATA to AttachmentController, such as a .jsp::$DATA file to io.jpress.web.commons.controller.AttachmentController#upload. NOTE: this is
- 7.5 High severity
jpress: Improper Control of Generation of Code
An issue in Jpress v.5.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the custom plug-in module function, a different vulnerability than CVE-2024-43033.