{"answers":{"affected":"It affects 1 product.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2019-19589 exists.","fix":"No fix has been published for CVE-2019-19589 yet. Limit exposure of the affected software until one is available.","what":"CVE-2019-19589 is a critical vulnerability in n/a, published on 5 Dec 2019. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2019-19589 and fix it if it is affected.\n\nWhat it is: CVE-2019-19589 is a critical vulnerability in n/a, published on 5 Dec 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2019-19589 exists.\n\nAffected product: n/a. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2019-19589/ (Markdown: https://insights.sbomify.com/CVE-2019-19589/index.md)","id":"CVE-2019-19589","markdown":"https://insights.sbomify.com/CVE-2019-19589/index.md","name":"CVE-2019-19589","record":{"aliases":["GHSA-7m2h-6596-w2g6"],"analysis":{"component_type":"cms_plugin","fix_type":"no_fix_stated","impacts":["code_execution"],"network_reachable":"yes","non_default_config":false,"product_category":"WordPress PDF plugin","requires_auth":"none","summary":"The plugin fails to block polyglot PDF files that are valid JAR archives, potentially allowing code execution if users download and execute them.","user_interaction":"not_required","vuln_class":"file_upload"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"mitre","cpe":[{"product":"pdf_embedder","vendor":"wp-pdf"}],"cvss":{"score":9.8,"severity":"critical","source":"cisa-adp","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-436","name":"Interpretation Conflict"}],"description":"The Lever PDF Embedder plugin 4.4 for WordPress does not block the distribution of polyglot PDF documents that are valid JAR archives. Note: It has been argued that \"The vulnerability reported in PDF Embedder Plugin is not valid as the plugin itself doesn't control or manage the file upload process. It only serves the uploaded PDF files and the responsibility of uploading PDF file remains with the Site owner of Wordpress installation, the upload of PDF file is managed by Wordpress core and not by PDF Embedder Plugin. Control \u0026 block of polyglot file is required to be taken care at the time of upload, not on showing the file. Moreover, the reference mentions retrieving the files from the browser cache and manually renaming it to jar for executing the file. That refers to a two step non-connected steps which has nothing to do with PDF Embedder.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":null,"headline":"File upload in n/a","id":"CVE-2019-19589","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"file_upload","year":"2019"},"n_packages":0,"n_references":2,"next":{"headline":"Use after free in n/a","id":"CVE-2019-19590"},"packages":[],"prev":{"headline":"Uncontrolled resource consumption in validators Python package","id":"CVE-2019-19588"},"products":["n/a"],"published":"2019-12-05","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"poc","technical_impact":"total"},"state":"PUBLISHED","updated":"2024-08-05","vendors":["n/a"]},"summary":"The plugin fails to block polyglot PDF files that are valid JAR archives, potentially allowing code execution if users download and execute them.","url":"https://insights.sbomify.com/CVE-2019-19589/"}