PT-2019-9869 · Silverpeas · Silverpeas

Publicado 2019-04-09 · Atualizado 2019-04-11 · CVE-2018-19586

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Silverpeas versions 5.15 through 6.0.2

Description The issue is an authenticated Directory Traversal vulnerability that occurs during file uploads. It is caused by the mishandling of a StringUtil.java call in core/webapi/upload/FileUploadData.java. This allows regular users to write arbitrary files on the underlying system with the privileges of the user running the application. An attacker can exploit this to write an executable JSP file in an exposed web directory, enabling them to execute commands on the underlying system.

Recommendations For Silverpeas versions 5.15 through 6.0.2, consider restricting file upload capabilities until a fix is available. As a temporary workaround, restrict access to the FileUploadData.java functionality to minimize the risk of exploitation. Additionally, monitor the system for any suspicious file uploads or modifications, especially in exposed web directories.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2018-19586

Produtos afetados

Silverpeas

Referências · 4

• 🔥 https://bishopfox.com/news/2019/01/silverpeas-5-15-to-6-0-2-path-traversal · Exploit
• https://github.com/Silverpeas/Silverpeas-Core/blob/d8c3bbb0695a4907db013401bd16c6527e2b4f41/core-web/src/main/java/org/silverpeas/core/webapi/upload/FileUploadData.java#L89 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2018-19586 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-19586 · Aviso do Fabricante