PT-2019-13819 · Leaf · Leaf Admin

Velocista · Published 2019-08-15 · Updated 2019-08-20 · CVE-2019-14755

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Leaf Admin version 61.9.0212.10

Description The issue concerns the profile photo upload feature, which allows the unrestricted upload of files with dangerous types.

Recommendations For Leaf Admin version 61.9.0212.10, consider restricting the types of files that can be uploaded through the profile photo upload feature to prevent potential exploitation. As a temporary workaround, consider disabling the profile photo upload feature until a more robust fix is available.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2019-14755

Affected Products

Leaf Admin

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2019-14755 · Security Note
• http://leaftecnologia.com.br · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-14755 · Vendor Advisory
• http://intruderlabs.com.br · Note
• https://gist.github.com/alacerda/8fd4557e585a8707e9d3b798968e24c1 · Note