CVEvulnerability
CVE-2019-19020
7.2 HIGH
Official page ↗
- Status
- Modified
- Published
- 2019-12-02
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 9.0 HIGH — AV:N/AC:L/Au:S/C:C/I:C/A:C
- Weaknesses
- CWE-434
Description
An issue was discovered in TitanHQ WebTitan before 5.18. In the administration web interface it is possible to upload a crafted backup file that enables an attacker to execute arbitrary code by overwriting existing files or adding new PHP files under the web root. This requires the attacker to have access to a valid web interface account.
Affected configurations
• titanhq webtitan (< 5.18)
Related
Weakness · CWE (1)
- CWE-434 Unrestricted Upload of File with Dangerous Type weakness
References
- https://write-up.github.io/webtitan/ Exploit, Third Party Advisory
- https://www.webtitan.com/resources/product-updates/ Release Notes, Vendor Advisory
- https://write-up.github.io/webtitan/ Exploit, Third Party Advisory
- https://www.webtitan.com/resources/product-updates/ Release Notes, Vendor Advisory