Improper File Upload Vulnerability in CKFinder by CKEditor
CVE-2019-15862

7.5HIGH

Key Information:

Vendor

Cksource

Status
Ckfinder
Vendor
CVE Published:
26 September 2019

What is CVE-2019-15862?

CKFinder versions up to 2.6.2.1 have an improper input validation issue that allows remote attackers to bypass restrictions on file uploads. This vulnerability permits the upload of files without any extension, despite the application's configuration to only accept specific file types. This presents significant security risks, enabling attackers to potentially upload malicious scripts disguised as legitimate files, leading to unauthorized access and control over the server.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

https://ckeditor.com/blog/CKFinder-3.5.1-and-CKFinder-2.6...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.