CVE-2024-0196

Summary

CVE-2024-0196 is a newly disclosed critical vulnerability in Magic-Api versions up to 2.0.1. The issue lies within an unknown functionality of the /resource/file/api/save?auto=1 endpoint, which allows for code injection. This manipulation can be executed remotely, making the attack vector especially dangerous. The exploit for this vulnerability (VDB-249511) has been made public, increasing the risk of potential exploitation. Users are strongly encouraged to update their Magic-Api installations to the latest version as soon as possible to mitigate this threat.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.