PT-2019-14776 · Unknown · Slub Events

Torben Hansen · Publicado 2019-10-16 · Atualizado 2022-05-24 · CVE-2019-16700

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions slub events extension versions 1.2.2 and earlier slub events extension versions later than 1.2.2 through 3.0.2

Description The issue allows uploading of arbitrary files to the webserver. For versions 1.2.2 and below, this results in Remote Code Execution. In versions later than 1.2.2, this can result in Denial of Service, since the web space can be filled up with arbitrary files.

Recommendations For versions 1.2.2 and earlier, update to a version later than 1.2.2 to prevent Remote Code Execution. For versions later than 1.2.2 through 3.0.2, restrict file upload capabilities to prevent Denial of Service. As a temporary workaround, consider disabling file upload functionality until a patch is available.

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2019-16700

GHSA-5PWW-3MFC-G8VR

Produtos afetados

Slub Events

Referências · 5

• https://osv.dev/vulnerability/GHSA-5pww-3mfc-g8vr · Aviso do Fabricante
• https://typo3.org/security/advisory/typo3-ext-sa-2019-017 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-16700 · Nota de Segurança
• https://extensions.typo3.org/extension/slub_events · Nota
• https://osv.dev/vulnerability/CVE-2019-16700 · Aviso do Fabricante