CVE-2019-11021

admin/app/mediamanager in Schlix CMS 2.1.8-7 allows Authenticated Unrestricted File Upload, leading to remote code execution. NOTE: "While inadvertently allowing a PHP file to be uploaded via Media Manager was an oversight, it still requires an admin permission. We think it's pretty rare for an administrator to exploit a bug on his/her own site to own his/her own site.

CVSS v3 7.2 HIGH
CVSS v2.0 6.5 MEDIUM

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://gurelahmet.com/schlix-cms-v2-1-8-7-authenticated-unrestricted-file-upload-to-rce/	Broken Link
https://vuldb.com/?id.144129
https://www.incibe-cert.es/en/early-warning/vulnerabilities/cve-2019-11021
https://www.schlix.com/html/schlix-cms-downloads.html	Product Release Notes
https://www.schlix.com/news/security/cve-2019-11021-for-older-schlix-cms-v2-1-8-7-november-2018.html

Configurations

Configuration 1 (hide)

cpe:2.3:a:schlix:cms:2.1.8-7:*:*:*:*:*:*:*

History

No history.

Information

Published : 2019-10-24 16:15

Updated : 2024-06-04 19:16

NVD link : CVE-2019-11021

Mitre link : CVE-2019-11021

CVE.ORG link : CVE-2019-11021

JSON object : View

Products Affected

schlix

cms

CWE

CWE-434

Unrestricted Upload of File with Dangerous Type

{"id": "CVE-2019-11021", "cveTags": [{"tags": ["disputed"], "sourceIdentifier": "cve@mitre.org"}], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2019-10-24T16:15:20.047", "references": [{"url": "https://gurelahmet.com/schlix-cms-v2-1-8-7-authenticated-unrestricted-file-upload-to-rce/", "tags": ["Broken Link"], "source": "cve@mitre.org"}, {"url": "https://vuldb.com/?id.144129", "source": "cve@mitre.org"}, {"url": "https://www.incibe-cert.es/en/early-warning/vulnerabilities/cve-2019-11021", "source": "cve@mitre.org"}, {"url": "https://www.schlix.com/html/schlix-cms-downloads.html", "tags": ["Product", "Release Notes"], "source": "cve@mitre.org"}, {"url": "https://www.schlix.com/news/security/cve-2019-11021-for-older-schlix-cms-v2-1-8-7-november-2018.html", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "admin/app/mediamanager in Schlix CMS 2.1.8-7 allows Authenticated Unrestricted File Upload, leading to remote code execution. NOTE: \"While inadvertently allowing a PHP file to be uploaded via Media Manager was an oversight, it still requires an admin permission. We think it's pretty rare for an administrator to exploit a bug on his/her own site to own his/her own site."}, {"lang": "es", "value": "** EN DISPUTA ** El archivo admin/app/mediamanager en Schlix CMS versi\u00f3n 2.1.8-7, permite una carga de archivos sin restricciones autenticada, lo que conlleva a la ejecuci\u00f3n de c\u00f3digo remota. NOTA: \"Si bien, sin darse cuenta, permite que un archivo PHP se cargue a trav\u00e9s de Media Manager fue un descuido,aunque se requiere un permiso de administrador. Creemos que es bastante raro que un administrador explote un error en su propio sitio para tener su propio sitio \"."}], "lastModified": "2024-06-04T19:16:57.237", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:schlix:cms:2.1.8-7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9D0C8BAE-A63D-409B-9510-FACD22C16335"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}