CVE-2019-19502

Опубликовано: 02 дек. 2019

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

Code injection in pluginconfig.php in Image Uploader and Browser for CKEditor before 4.1.9 allows remote authenticated users to execute arbitrary PHP code.

Ссылки

https://github.com/xsmo/Image-Uploader-and-Browser-for-CKEditor/commit/c293d38c8b99444e775d94c1af50c9676c6544d2
Patch
https://github.com/xsmo/Image-Uploader-and-Browser-for-CKEditor/compare/4.1.8...v4.1.9
Third Party Advisory
https://github.com/xsmo/Image-Uploader-and-Browser-for-CKEditor/pull/11
Third Party Advisory
https://github.com/xsmo/Image-Uploader-and-Browser-for-CKEditor/pull/11/commits/5c7a6b0e10504f08e2f50655541b767e276ce749
Patch
https://visat.me/security/cve-2019-19502/
https://github.com/xsmo/Image-Uploader-and-Browser-for-CKEditor/commit/c293d38c8b99444e775d94c1af50c9676c6544d2
Patch
https://github.com/xsmo/Image-Uploader-and-Browser-for-CKEditor/compare/4.1.8...v4.1.9
Third Party Advisory
https://github.com/xsmo/Image-Uploader-and-Browser-for-CKEditor/pull/11
Third Party Advisory
https://github.com/xsmo/Image-Uploader-and-Browser-for-CKEditor/pull/11/commits/5c7a6b0e10504f08e2f50655541b767e276ce749
Patch
https://visat.me/security/cve-2019-19502/

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:maleck:image_uploader_and_browser_for_ckeditor:*:*:*:*:*:*:*:*

Версия до 4.1.9 (исключая)

EPSS

Процентиль: 74%

0.00853

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-94

Связанные уязвимости

GHSA-7426-cf9r-3rp5

github

больше 3 лет назад

pluginconfig.php in the Image Uploader and Browser plugin before 4.1.9 for CKEditor mishandles certain characters in pathnames.