CVE-2019-11021

Name of the Vulnerable Software and Affected Versions Schlix CMS version 2.1.8-7

Description The issue allows authenticated unrestricted file upload, leading to remote code execution. This can be achieved through the admin/app/mediamanager endpoint. It requires admin permission to exploit, making it less likely for an administrator to intentionally exploit this on their own site.

Recommendations For Schlix CMS version 2.1.8-7, consider restricting access to the admin/app/mediamanager endpoint until a fix is available, and ensure that admin permissions are tightly controlled to minimize the risk of exploitation.