PT-2019-14371 · Sitos · Sitos Six

Published 2019-10-07 · Updated 2019-10-09 · CVE-2019-15751

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SITOS six Build version 6.2.1

Description The issue allows remote attackers to execute arbitrary code by uploading a SCORM file with an executable extension. An unauthenticated attacker can upload a malicious file, containing PHP code, to the web root of the application, enabling the execution of operating system commands.

Recommendations For SITOS six Build version 6.2.1, restrict access to file upload functionality to prevent unauthenticated users from uploading malicious files until a fix is available. Consider implementing validation and sanitization of uploaded files to prevent executable code from being uploaded.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2019-15751

Affected Products

Sitos Six

References · 3

• https://osv.dev/vulnerability/CVE-2019-15751 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-15751 · Security Note
• https://contextis.com/en/resources/advisories/cve-2019-15751 · Note