PT-2019-14491 · Total.Js · Total.Js Cms

Riccardo Krauter · Publicado 2019-09-05 · Atualizado 2022-05-24 · CVE-2019-15952

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Total.js CMS version 12.0.0

Description An issue in Total.js CMS allows an authenticated user with the Pages privilege to conduct a path traversal attack to include .html files outside the permitted directory. If a page contains a template directive, it will be server-side processed, potentially leading to Remote Command Execution if a user can control the content of a .html file and inject a malicious template directive.

Recommendations For Total.js CMS version 12.0.0, restrict access to the Pages privilege and avoid allowing users to control the content of .html files to minimize the risk of exploitation. As a temporary workaround, consider disabling the processing of template directives in .html files until a patch is available.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2019-15952

GHSA-PWVP-H579-HFXG

Produtos afetados

Total.Js Cms

Referências · 8

• 🔥 https://github.com/beerpwn/CVE/blob/master/Totaljs_disclosure_report/report_final.pdf · Exploit
• 🔥 https://seclists.org/fulldisclosure/2019/Sep/2 · Exploit
• https://github.com/totaljs/cms · Nota
• http://seclists.org/fulldisclosure/2019/Sep/11 · Nota
• http://packetstormsecurity.com/files/154340/Totaljs-CMS-12.0-Path-Traversal.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-15952 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-15952 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-pwvp-h579-hfxg · Aviso do Fabricante