Threats tagged 'ghsa-7x97-5m4c-4jvm'

eGovFramework/egovframe-common-components versions up to and including 4.3.1 have an unauthenticated file upload vulnerability via specific image upload endpoints. The flaw allows attackers to upload files without authentication, which are then stored on the server and accessible via a download URL. Prior to version 4.1.2, the attacker could control the MIME type of the served file, increasing risk. Since 4.1.2, uploaded non-image files are served with a fixed content type, limiting some risk. This vulnerability enables an attacker to use the affected application as a persistent file hosting service for arbitrary content.