PT-2019-14371 · Sitos · Sitos Six

Publicado 2019-10-07 · Atualizado 2019-10-09 · CVE-2019-15751

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SITOS six Build version 6.2.1

Description The issue allows remote attackers to execute arbitrary code by uploading a SCORM file with an executable extension. An unauthenticated attacker can upload a malicious file, containing PHP code, to the web root of the application, enabling the execution of operating system commands.

Recommendations For SITOS six Build version 6.2.1, restrict access to file upload functionality to prevent unauthenticated users from uploading malicious files until a fix is available. Consider implementing validation and sanitization of uploaded files to prevent executable code from being uploaded.

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2019-15751

Produtos afetados

Sitos Six

Referências · 3

• https://osv.dev/vulnerability/CVE-2019-15751 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-15751 · Nota de Segurança
• https://contextis.com/en/resources/advisories/cve-2019-15751 · Nota