PT-2019-12286 · Siteserver · Siteserver Cms

Diy0829 · Publicado 2019-04-21 · Atualizado 2022-05-24 · CVE-2019-11401

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SiteServer CMS versions 6.9.0 through 6.11

Description A issue was discovered in SiteServer CMS that allows remote attackers to execute arbitrary code. This is possible because an administrator can add the permitted file extension .aassp, which is converted to .asp due to the deletion of the "as" substring.

Recommendations For SiteServer CMS versions 6.9.0 through 6.11, update to version 6.12 or later to resolve the issue.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2019-11401

GHSA-FF4W-8CHR-W2X9

Produtos afetados

Siteserver Cms

Referências · 6

• 🔥 https://github.com/siteserver/cms/issues/1858 · Exploit
• https://github.com/siteserver/cms · Nota
• https://github.com/siteserver/cms/commit/a7edb9ce3f9b52be3d18fa8a0e44931264e22436#diff-c8a06aaffb97eb2f4c587c1786906edd49dea574d063f74a59d9653ee0d5718b · Nota
• https://osv.dev/vulnerability/GHSA-ff4w-8chr-w2x9 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-11401 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-11401 · Nota de Segurança