GitHub Advisoryadvisory · NuGet

GHSA-ff4w-8chr-w2x9 SiteServer CMS RCE via unsafe file upload

HIGH Published 2022-05-24 Modified 2023-08-25 Official page ↗
Aliases
CVE-2019-11401
Ecosystem
NuGet
Packages
sscms
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-434
Reviewed
2023-07-14

Affected packages

• NuGet sscms: < 6.12 → fixed in 6.12

Description

A issue was discovered in SiteServer CMS prior to version 6.12. It allows remote attackers to execute arbitrary code because an administrator can add the permitted file extension `.aassp`, which is converted to `.asp` because the "as" substring is deleted.

Related

Alias · CVE (1)

  • CVE-2019-11401 A issue was discovered in SiteServer CMS 6.9.0. vulnerability

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References