File Upload Vulnerability in GetSimpleCMS by GetSimpleCMS
CVE-2018-19421

3.8LOW

Key Information:

Vendor

Get-simple

Status
Getsimple Cms
Vendor
CVE Published:
21 November 2018

What is CVE-2018-19421?

In GetSimpleCMS version 3.3.15, an issue exists in the file upload functionality that allows for the potential execution of HTML content. Despite the platform’s attempts to block .html uploads in the admin/upload.php file, the vulnerability arises from how Internet Explorer interacts with .eml files, permitting HTML elements to be processed if potentially harmful files are uploaded through admin/upload-uploadify.php. This highlights a significant risk in the validation and security measures applied to file uploads, particularly concerning the validate_safe_file function in admin/inc/security_functions.php.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1301
x_refsource_MISC

CVSS V3.1

Score:
3.8
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability Reserved

  • Vulnerability published

JSON
.