CVE-2024-58298: Bmc Software Compuware Istrobe Web

Critical severity, CVSS 9.2. EPSS: 1% chance of exploitation in the next 30 days.

Compuware iStrobe Web 20.13 contains a pre-authentication remote code execution vulnerability that allows unauthenticated attackers to upload malicious JSP files through a path traversal in the file upload form. Attackers can exploit the 'fileName' parameter to upload a web shell and execute arbitrary commands by sending POST requests to the uploaded JSP endpoint.

Affected products

• Bmc Software Compuware Istrobe Web: version 20.13 only

Published 2025-12-11. Last modified 2026-10-02.