PT-2019-12269 · Projectsend · Projectsend

Lmsilva · Publicado 2019-04-20 · Atualizado 2021-07-21 · CVE-2019-11378

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ProjectSend version r1053

Description An issue was discovered that allows directory traversal through the upload-process-form.php file, potentially enabling users to read arbitrary files, access the supporting database, delete arbitrary files, access user passwords, or run arbitrary code.

Recommendations For ProjectSend version r1053, consider restricting access to the upload-process-form.php file until a patch is available to prevent directory traversal attacks. As a temporary workaround, limit the ability of users to upload files to prevent potential exploitation.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2019-11378

Produtos afetados

Projectsend

Referências · 4

• 🔥 https://github.com/projectsend/projectsend/issues/700 · Exploit
• http://securityfocus.com/bid/108069 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-11378 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-11378 · Aviso do Fabricante