CVE-2019-11021 File upload in n/a
Authenticated administrators can upload PHP files via the Media Manager, leading to remote code execution on the server.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-11021?
CVE-2019-11021 is a high-severity vulnerability in n/a, published on 24 Oct 2019. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
admin/app/mediamanager in Schlix CMS 2.1.8-7 allows Authenticated Unrestricted File Upload, leading to remote code execution. NOTE: "While inadvertently allowing a PHP file to be uploaded via Media Manager was an oversight, it still requires an admin permission. We think it's pretty rare for an administrator to exploit a bug on his/her own site to own his/her own site.
Weakness: CWE-434
Which versions are affected by CVE-2019-11021?
It affects 1 product.
Products include Schlix Cms.
How do I fix CVE-2019-11021?
No fix has been published for CVE-2019-11021 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-11021 being exploited?
There is no known exploitation of CVE-2019-11021 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-vf88-cw97-53gc.