CVE-2024-24024

Summary

CVE-2024-24024 is a newly disclosed vulnerability affecting Novel-Plus version 4.3.0-RC1 and earlier. The issue lies in the fileDownload() method of com.java2nb.common.controller.FileController. An attacker can exploit this vulnerability by providing maliciously crafted filePath and fileName parameters, enabling them to download arbitrary files from the affected system. This vulnerability poses a significant risk, as it allows unauthorized access to sensitive data, potentially leading to data breaches or system compromise. Users are advised to upgrade to a patched version of Novel-Plus as soon as possible to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.