CVE-2019-11028

Опубликовано: 09 апр. 2019

Источник: nvd

CVSS3: 8.8

CVSS2: 6.5

EPSS Низкий

Описание

GAT-Ship Web Module before 1.40 suffers from a vulnerability allowing authenticated attackers to upload any file type to the server via the "Documents" area. This vulnerability is related to "uploadDocFile.aspx".

Ссылки

http://packetstormsecurity.com/files/152643/GAT-Ship-Web-Module-Unrestricted-File-Upload.html
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2019/Apr/33
Mailing List
Third Party Advisory
https://seclists.org/fulldisclosure/2019/Apr/14
Mailing List
Third Party Advisory
https://vuldb.com/?id.133141
Third Party Advisory
http://packetstormsecurity.com/files/152643/GAT-Ship-Web-Module-Unrestricted-File-Upload.html
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2019/Apr/33
Mailing List
Third Party Advisory
https://seclists.org/fulldisclosure/2019/Apr/14
Mailing List
Third Party Advisory
https://vuldb.com/?id.133141
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:gatship:web_module:*:*:*:*:*:*:*:*

Версия до 1.40 (исключая)

EPSS

Процентиль: 73%

0.00757

Низкий

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-434

Связанные уязвимости

GHSA-5568-w2qw-frj9