CVE-2019-3489 File upload in Micro Focus Content Manager
Unauthenticated attackers can upload files to arbitrary locations on Micro Focus Content Manager servers when ADFS authentication is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-3489?
CVE-2019-3489 is a high-severity vulnerability in Micro Focus Content Manager, published on 1 Apr 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An unauthenticated file upload vulnerability has been identified in the Web Client component of Micro Focus Content Manager 9.1, 9.2, and 9.3 when configured to use the ADFS authentication method. The vulnerability could be exploited by an unauthenticated remote attacker to upload content to arbitrary locations on the Content Manager server.
Weakness: CWE-434
Which versions are affected by CVE-2019-3489?
It affects 1 product.
Products include Microfocus Content Manager.
How do I fix CVE-2019-3489?
No fix has been published for CVE-2019-3489 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-3489 being exploited?
There is no known exploitation of CVE-2019-3489 in the wild and no public exploit code.
Other vulnerabilities in Micro Focus Content Manager
Sources
Also known as GHSA-p594-hvv6-pr97.