7.2
CVE-2019-11401
- EPSS 2.87%
- Veröffentlicht 22.04.2019 11:29:04
- Zuletzt bearbeitet 21.11.2024 04:21:02
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
LoginA issue was discovered in SiteServer CMS 6.9.0. It allows remote attackers to execute arbitrary code because an administrator can add the permitted file extension .aassp, which is converted to .asp because the "as" substring is deleted.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Siteserver ≫ Siteserver Cms Version6.9.0
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 2.87% | 0.85 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 7.2 | 1.2 | 5.9 |
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 6.5 | 8 | 6.4 |
AV:N/AC:L/Au:S/C:P/I:P/A:P
|
CWE-434 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
https://github.com/siteserver/cms/issues/1858