PT-2019-12143 · Schlix · Schlix Cms

Published 2019-10-24 · Updated 2024-08-04 · CVE-2019-11021

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Schlix CMS version 2.1.8-7

Description The issue allows authenticated unrestricted file upload, leading to remote code execution. This can be achieved through the admin/app/mediamanager endpoint. It requires admin permission to exploit, making it less likely for an administrator to intentionally exploit this on their own site.

Recommendations For Schlix CMS version 2.1.8-7, consider restricting access to the admin/app/mediamanager endpoint until a fix is available, and ensure that admin permissions are tightly controlled to minimize the risk of exploitation.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2019-11021

Affected Products

Schlix Cms

References · 7

• https://osv.dev/vulnerability/CVE-2019-11021 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11021 · Security Note
• https://incibe-cert.es/en/early-warning/vulnerabilities/cve-2019-11021 · Note
• https://schlix.com/html/schlix-cms-downloads.html · Note
• https://gurelahmet.com/schlix-cms-v2-1-8-7-authenticated-unrestricted-file-upload-to-rce · Note
• https://vuldb.com/?id.144129 · Note
• https://schlix.com/news/security/cve-2019-11021-for-older-schlix-cms-v2-1-8-7-november-2018.html · Note