Compuware iStrobe Web 20.13 Pre-Auth Remote Code Execution via File Upload
Vulnerability Description
Compuware iStrobe Web 20.13 contains a pre-authentication remote code execution vulnerability that allows unauthenticated attackers to upload malicious JSP files through a path traversal in the file upload form. Attackers can exploit the 'fileName' parameter to upload a web shell and execute arbitrary commands by sending POST requests to the uploaded JSP endpoint.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-58298
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- trancap, Guest
Affected Vendor
BMC Software
View all reports →