CVE-2019-15123 File upload in n/a
Authenticated attackers can upload malicious .aspx files via the branding module to achieve remote code execution on the website.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-15123?
CVE-2019-15123 is a high-severity vulnerability in n/a, published on 12 Jun 2020. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The Branding Module in Viki Vera 4.9.1.26180 allows an authenticated user to change the logo on the website. An attacker could use this to upload a malicious .aspx file and gain Remote Code Execution on the site.
Weakness: CWE-434
Which versions are affected by CVE-2019-15123?
It affects 1 product.
Products include Vikisolutions Vera.
How do I fix CVE-2019-15123?
No fix has been published for CVE-2019-15123 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-15123 being exploited?
There is no known exploitation of CVE-2019-15123 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-3fvv-4h43-9g7x.