PT-2019-13866 · Google · Gcdwebserver

Sios-Submission · Publicado 2019-08-10 · Atualizado 2021-07-21 · CVE-2019-14924

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions GCDWebServer versions prior to 3.5.3

Description An issue in the GCDWebUploader class allows an adversary to make an inaccessible file available by leveraging the fact that the moveItem method checks the FileExtension of newAbsolutePath but not oldAbsolutePath. This could potentially expose sensitive information, such as app credentials.

Recommendations For versions prior to 3.5.3, update to version 3.5.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the moveItem method in the GCDWebUploader class until a patch is available.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2019-14924

Produtos afetados

Gcdwebserver

Referências · 5

• https://github.com/swisspol/GCDWebServer/compare/3.5.2...3.5.3 · Correção
• https://github.com/swisspol/GCDWebServer/issues/433 · Nota
• https://github.com/swisspol/GCDWebServer/commit/02738433bf2e1b820ef48f04edd15df304081802 · Correção
• https://osv.dev/vulnerability/CVE-2019-14924 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-14924 · Nota de Segurança