CVE-2019-11401 SiteServer CMS RCE via unsafe file upload
Remote attackers can execute arbitrary code by uploading files with a specific extension that bypasses validation filters in SiteServer CMS.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-11401?
CVE-2019-11401 is a high-severity vulnerability in n/a, published on 21 Apr 2019. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A issue was discovered in SiteServer CMS 6.9.0. It allows remote attackers to execute arbitrary code because an administrator can add the permitted file extension .aassp, which is converted to .asp because the "as" substring is deleted.
Weakness: CWE-434
Which versions are affected by CVE-2019-11401?
2 open source packages ship an affected version, including sscms. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
sscms NuGet | All versions | 6.12 |
sscms NuGet | All versions | 6.12 |
Products include Siteserver Siteserver Cms.
How do I fix CVE-2019-11401?
Upgrade sscms to 6.12 or later.
Is CVE-2019-11401 being exploited?
There is no known exploitation of CVE-2019-11401 in the wild and no public exploit code.
Sources
Also known as GHSA-ff4w-8chr-w2x9.