PT-2019-13866 · Google · Gcdwebserver

Sios-Submission · Published 2019-08-10 · Updated 2021-07-21 · CVE-2019-14924

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions GCDWebServer versions prior to 3.5.3

Description An issue in the GCDWebUploader class allows an adversary to make an inaccessible file available by leveraging the fact that the moveItem method checks the FileExtension of newAbsolutePath but not oldAbsolutePath. This could potentially expose sensitive information, such as app credentials.

Recommendations For versions prior to 3.5.3, update to version 3.5.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the moveItem method in the GCDWebUploader class until a patch is available.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2019-14924

Affected Products

Gcdwebserver

References · 5

• https://github.com/swisspol/GCDWebServer/compare/3.5.2...3.5.3 · Patch
• https://github.com/swisspol/GCDWebServer/commit/02738433bf2e1b820ef48f04edd15df304081802 · Patch
• https://osv.dev/vulnerability/CVE-2019-14924 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-14924 · Security Note
• https://github.com/swisspol/GCDWebServer/issues/433 · Note