CVE-2019-19902 File upload in n/a
An attacker with admin permissions can upload malicious scripts via configuration archives, potentially leading to remote code execution if other scripting languages are enabled.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-19902?
CVE-2019-19902 is a high-severity vulnerability in n/a, published on 19 Dec 2019. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2. It allows the upload of entire-site configuration archives through the user interface or command line. It does not sufficiently check uploaded archives for invalid data, allowing non-configuration scripts to potentially be uploaded to the server. This issue is mitigated by the fact that the attacker would be required to have the "Synchronize, import, and export configuration" permission, a permission that only trusted administrators should be given. Other measures in the product prevent the execution of PHP scripts, so another server-side scripting language must be accessible on the server to execute code.
Weakness: CWE-20
Which versions are affected by CVE-2019-19902?
It affects 1 product.
Products include Backdropcms Backdrop Cms.
How do I fix CVE-2019-19902?
No fix has been published for CVE-2019-19902 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-19902 being exploited?
There is no known exploitation of CVE-2019-19902 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-h8jv-w343-48r6.