PT-2020-9661 · Viki Vera · Viki Vera

Published 2020-06-12 · Updated 2020-06-23 · CVE-2019-15123

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Viki Vera version 4.9.1.26180

Description The Branding Module in Viki Vera allows an authenticated user to change the logo on the website. An attacker could use this to upload a malicious .aspx file and gain Remote Code Execution on the site.

Recommendations For version 4.9.1.26180, consider disabling the logo upload feature in the Branding Module until a patch is available to prevent potential Remote Code Execution attacks. Restrict access to the Branding Module to minimize the risk of exploitation. Avoid using the module for uploading files until the issue is resolved.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2019-15123

Affected Products

Viki Vera

References · 6

• https://osv.dev/vulnerability/CVE-2019-15123 · Vendor Advisory
• http://vikisolutions.com/products/Vera.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-15123 · Security Note
• https://t.me/cvenotify/4338 · Telegram Post
• https://t.me/cibsecurity/12726 · Telegram Post
• https://gosecure.net/blog/2020/06/11/vera-vulnerable-to-authenticated-remote-code-execution-cve-2019-15123 · Note