PT-2019-15098 · Jfinal · Jfinal

Glassyamadeus · Publicado 2019-10-08 · Atualizado 2022-05-25 · CVE-2019-17352

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions JFinal cos before 2019-08-13 JFinal version 4.4

Description The issue allows bypassing the isSafeFile() function, enabling the upload of any file type. For instance, a .jsp file can be uploaded, stored, and potentially deleted immediately, but certain exceptions may prevent this deletion.

Recommendations For JFinal cos before 2019-08-13, consider updating to a version released after 2019-08-13 to address the issue. For JFinal version 4.4, consider updating to a version that incorporates the fix for the isSafeFile() function bypass vulnerability.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2019-17352

GHSA-279P-PC38-XX4P

Produtos afetados

Jfinal

Referências · 7

• 🔥 https://github.com/jfinal/jfinal/issues/171 · Exploit
• https://osv.dev/vulnerability/GHSA-279p-pc38-xx4p · Aviso do Fabricante
• https://gitee.com/jfinal/cos/commit/5eb23d6e384abaad19faa7600d14c9a2f525946a · Aviso do Fabricante
• https://gitee.com/jfinal/cos/commit/8d26eec61f0d072a68bf7393cf3a8544a1112130 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-17352 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-17352 · Nota de Segurança
• https://gitee.com/jfinal/cos · Nota