CVE-2024-38529
Admidio remote code execution
- Published29 Jul 2024
Description
Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.3.10, there is a Remote Code Execution Vulnerability in the Message module of the Admidio Application, where it is possible to upload a PHP file in the attachment. The uploaded file can be accessed publicly through the URL `{admidio_base_url}/adm_my_files/messages_attachments/{file_name}`. The vulnerability is caused due to the lack of file extension verification, allowing malicious files to be uploaded to the server and public availability of the uploaded file. This vulnerability is fixed in 4.3.10.
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:HAffected products
Remediation
Frequently asked
Is CVE-2024-38529 being actively exploited?
CVE-2024-38529 is not in the CISA KEV catalog. Its EPSS exploit probability is 1.24%.
How severe is CVE-2024-38529?
CVE-2024-38529 has a CVSS 3.1 base score of 9.0, rated critical. EPSS estimates a 1.24% probability of exploitation.
Which products are affected by CVE-2024-38529?
Affected products include Admidio.
How do I fix CVE-2024-38529?
Upgrade affected software to a fixed version, for example Admidio 4.3.10 or later, then confirm no affected versions remain in your inventory.
How Secuno handles this
Secuno correlates vulnerabilities like CVE-2024-38529 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.
Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.