CVEvulnerability
CVE-2019-14924
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2019-08-10
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 7.5 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-863
Description
An issue was discovered in GCDWebServer before 3.5.3. The method moveItem in the GCDWebUploader class checks the FileExtension of newAbsolutePath but not oldAbsolutePath. By leveraging this vulnerability, an adversary can make an inaccessible file be available (the credential of the app, for instance).
Affected configurations
• gcdwebserver project gcdwebserver (< 3.5.3)
Related
Weakness · CWE (1)
- CWE-863 Incorrect Authorization weakness
References
- https://github.com/swisspol/GCDWebServer/commit/02738433bf2e1b820ef48f04edd15df304081802 Patch, Third Party Advisory
- https://github.com/swisspol/GCDWebServer/compare/3.5.2...3.5.3 Patch, Third Party Advisory
- https://github.com/swisspol/GCDWebServer/issues/433 Third Party Advisory
- https://github.com/swisspol/GCDWebServer/commit/02738433bf2e1b820ef48f04edd15df304081802 Patch, Third Party Advisory
- https://github.com/swisspol/GCDWebServer/compare/3.5.2...3.5.3 Patch, Third Party Advisory
- https://github.com/swisspol/GCDWebServer/issues/433 Third Party Advisory