CVE-2024-37928: Arbitrary File Access in Jobmonster

The Arbitrary File Access vulnerability in Jobmonster allows an attacker to read or write files outside of the intended directory. This can be exploited to read sensitive configuration files, database credentials, or even upload malicious code. Successful exploitation could lead to complete server compromise, data theft, and denial of service. The ability to write arbitrary files significantly expands the attack surface, potentially allowing for remote code execution if the attacker can upload a web shell or modify existing PHP files.

1. Reserved2024-06-10
2. Published2024-07-12
3. Modified2024-08-02
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-37928 is to immediately upgrade Jobmonster to version 4.7.1 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to block requests containing path traversal sequences (e.g., ../). Restrict file upload permissions and carefully review any file uploads processed by the Jobmonster plugin. Monitor server logs for suspicious file access attempts.