PT-2018-14399
CVE-2018-18315
·
تاريخ النشر
2018-10-15
·
تاريخ التحديث
2019-01-11
الوصف من
CVSS 3.1
7.5
عاليةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions
lemon version 1.9.0
Description
The issue allows attackers to upload arbitrary files due to insufficient validation in the
copyMultipartFileToFile method within CdnUtils. Specifically, it only checks for a ../ substring and does not validate the file type and spaceName parameter.Recommendations
For lemon version 1.9.0, consider validating the file type and
spaceName parameter in the copyMultipartFileToFile method to prevent arbitrary file uploads. As a temporary workaround, restrict access to the CdnController to minimize the risk of exploitation. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾