PT-2019-15943 · Contao · Contao

Leo Feyer · Publicado 2019-12-17 · Atualizado 2019-12-18 · CVE-2019-19745

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Contao versions 4.0 through 4.8.5

Description The issue allows a back end user with access to the form generator to upload arbitrary files and execute them on the server, enabling PHP local file inclusion. This can be exploited by a user with access to the form generator.

Recommendations Update to Contao 4.4.46 or 4.8.6. As a temporary workaround, configure your web server so it does not execute PHP files and other scripts in the Contao file upload directory.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2019-19745

GHSA-WJX8-CGRM-HH8P

Produtos afetados

Contao

Referências · 10

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2019-19745.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2019-19745.yaml · Exploit
• https://github.com/contao/contao · Nota
• https://github.com/contao/contao/security/advisories/GHSA-wjx8-cgrm-hh8p · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-19745 · Nota de Segurança
• https://contao.org/en/security-advisories/unrestricted-file-uploads.html · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19745 · Nota
• https://contao.org/en/news.html · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-wjx8-cgrm-hh8p · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-19745 · Aviso do Fabricante