PT-2018-14954
CVE-2018-19420
·
تاريخ النشر
2018-11-21
·
تاريخ التحديث
2018-12-28
الوصف من
CVSS 2.0
4.0
متوسطةالمقاييسAV:N/AC:L/Au:S/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions
GetSimpleCMS version 3.3.15
Description
The issue allows HTML execution through alternative file uploads. This can occur with files having no extension or unrecognized extensions, such as 'test' or 'test.asdf', due to vulnerabilities in admin/upload-uploadify.php and the validate safe file function in admin/inc/security functions.php.
Recommendations
For GetSimpleCMS version 3.3.15, consider restricting or validating file uploads more strictly to prevent HTML execution, and review the validate safe file function in admin/inc/security functions.php to ensure it correctly handles files with no or unrecognized extensions.
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾