PT-2022-22434 · Zengenti · Zengenti Contensis Classic
CVE-2022-34919
·
Published
2022-08-23
·
Updated
2022-08-25
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Zengenti Contensis Classic versions prior to 15.2.1.79
Description
The file upload wizard does not correctly check that a user has authenticated, allowing the execution of arbitrary commands by uploading a crafted aspx file.
Recommendations
For versions prior to 15.2.1.79, update to version 15.2.1.79 or later to resolve the issue. As a temporary workaround, consider restricting access to the file upload wizard to minimize the risk of exploitation.
Exploit
Fix
Improper Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Zengenti Contensis Classic