PT-2019-13819 · Leaf · Leaf Admin

Velocista · Publicado 2019-08-15 · Atualizado 2019-08-20 · CVE-2019-14755

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Leaf Admin version 61.9.0212.10

Description The issue concerns the profile photo upload feature, which allows the unrestricted upload of files with dangerous types.

Recommendations For Leaf Admin version 61.9.0212.10, consider restricting the types of files that can be uploaded through the profile photo upload feature to prevent potential exploitation. As a temporary workaround, consider disabling the profile photo upload feature until a more robust fix is available.

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2019-14755

Produtos afetados

Leaf Admin

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2019-14755 · Nota de Segurança
• http://intruderlabs.com.br · Nota
• http://leaftecnologia.com.br · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-14755 · Aviso do Fabricante
• https://gist.github.com/alacerda/8fd4557e585a8707e9d3b798968e24c1 · Nota