ZDI-24-106: Allegra renderFieldMatch Deserialization of Unstrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Although authentication is required to exploit this vulnerability, product implements a registration mechanism that can be used to create a user with a sufficient privilege level. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2024-22505.

arbitrary code attackers authentication can code code execution cvss data deserialization exploit mechanism privilege product rating registration remote code remote code execution vulnerability zdi