PT-2019-9869 · Silverpeas · Silverpeas

Published 2019-04-09 · Updated 2019-04-11 · CVE-2018-19586

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Silverpeas versions 5.15 through 6.0.2

Description The issue is an authenticated Directory Traversal vulnerability that occurs during file uploads. It is caused by the mishandling of a StringUtil.java call in core/webapi/upload/FileUploadData.java. This allows regular users to write arbitrary files on the underlying system with the privileges of the user running the application. An attacker can exploit this to write an executable JSP file in an exposed web directory, enabling them to execute commands on the underlying system.

Recommendations For Silverpeas versions 5.15 through 6.0.2, consider restricting file upload capabilities until a fix is available. As a temporary workaround, restrict access to the FileUploadData.java functionality to minimize the risk of exploitation. Additionally, monitor the system for any suspicious file uploads or modifications, especially in exposed web directories.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2018-19586

Affected Products

Silverpeas

References · 4

• 🔥 https://bishopfox.com/news/2019/01/silverpeas-5-15-to-6-0-2-path-traversal · Exploit
• https://github.com/Silverpeas/Silverpeas-Core/blob/d8c3bbb0695a4907db013401bd16c6527e2b4f41/core-web/src/main/java/org/silverpeas/core/webapi/upload/FileUploadData.java#L89 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2018-19586 · Security Note
• https://osv.dev/vulnerability/CVE-2018-19586 · Vendor Advisory