PT-2019-12286 · Siteserver · Siteserver Cms

Diy0829 · Published 2019-04-21 · Updated 2022-05-24 · CVE-2019-11401

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SiteServer CMS versions 6.9.0 through 6.11

Description A issue was discovered in SiteServer CMS that allows remote attackers to execute arbitrary code. This is possible because an administrator can add the permitted file extension .aassp, which is converted to .asp due to the deletion of the "as" substring.

Recommendations For SiteServer CMS versions 6.9.0 through 6.11, update to version 6.12 or later to resolve the issue.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2019-11401

GHSA-FF4W-8CHR-W2X9

Affected Products

Siteserver Cms

References · 6

• 🔥 https://github.com/siteserver/cms/issues/1858 · Exploit
• https://osv.dev/vulnerability/GHSA-ff4w-8chr-w2x9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-11401 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11401 · Security Note
• https://github.com/siteserver/cms · Note
• https://github.com/siteserver/cms/commit/a7edb9ce3f9b52be3d18fa8a0e44931264e22436#diff-c8a06aaffb97eb2f4c587c1786906edd49dea574d063f74a59d9653ee0d5718b · Note