PT-2020-18491
CVE-2020-5514
·
تاريخ النشر
2020-01-06
·
تاريخ التحديث
2020-01-09
الوصف من
CVSS 3.1
9.1
حرجةالمقاييسAV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Gila CMS version 1.11.8
Description
The issue allows for the unrestricted upload of a file with a dangerous type via
.phar or .phtml to the /lzld/thumb?src= API endpoint. This could potentially lead to security risks.Recommendations
For Gila CMS version 1.11.8, restrict access to the
/lzld/thumb?src= API endpoint to prevent the upload of malicious files until a fix is available. Consider implementing file type validation and restrictions to mitigate the risk of exploitation. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾