CVE-2019-1010062 - Vulnerability Details - OpenCVE

ReportizFlow

PluckCMS 4.7.4 and earlier is affected by: CWE-434 Unrestricted Upload of File with Dangerous Type. The impact is: get webshell. The component is: data/inc/images.php line36. The attack vector is: modify the MIME TYPE on HTTP request to upload a php file. The fixed version is: after commit 09f0ab871bf633973cfd9fc4fe59d4a912397cf8.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:N/AC:L/Au:N/C:P/I:P/A:P

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Pluck-cms	Pluckcms

Configuration 1 [-]

cpe:2.3:a:pluck-cms:pluckcms:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/pluck-cms/pluck/commit/09f0ab871bf633973cfd9fc4fe59d4a912397cf8
https://github.com/pluck-cms/pluck/issues/44

History

No history.

MITRE

Status: PUBLISHED

Assigner: dwf

Published: 2019-07-16T12:24:15

Updated: 2024-08-05T03:07:18.171Z

Reserved: 2019-03-20T00:00:00

Link: CVE-2019-1010062

Vulnrichment

No data.

NVD

Status : Modified

Published: 2019-07-16T13:15:11.410

Modified: 2024-11-21T04:17:57.210

Link: CVE-2019-1010062

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "PluckCMS", "vendor": "pluck-cms", "versions": [{"status": "affected", "version": "\u2264 4.7.4 [fixed: after commit 09f0ab871bf633973cfd9fc4fe59d4a912397cf8]"}]}], "descriptions": [{"lang": "en", "value": "PluckCMS 4.7.4 and earlier is affected by: CWE-434 Unrestricted Upload of File with Dangerous Type. The impact is: get webshell. The component is: data/inc/images.php line36. The attack vector is: modify the MIME TYPE on HTTP request to upload a php file. The fixed version is: after commit 09f0ab871bf633973cfd9fc4fe59d4a912397cf8."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2019-07-16T12:24:15", "orgId": "7556d962-6fb7-411e-85fa-6cd62f095ba8", "shortName": "dwf"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://github.com/pluck-cms/pluck/commit/09f0ab871bf633973cfd9fc4fe59d4a912397cf8"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/pluck-cms/pluck/issues/44"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "[email protected]", "ID": "CVE-2019-1010062", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "PluckCMS", "version": {"version_data": [{"version_value": "\u2264 4.7.4 [fixed: after commit 09f0ab871bf633973cfd9fc4fe59d4a912397cf8]"}]}}]}, "vendor_name": "pluck-cms"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "PluckCMS 4.7.4 and earlier is affected by: CWE-434 Unrestricted Upload of File with Dangerous Type. The impact is: get webshell. The component is: data/inc/images.php line36. The attack vector is: modify the MIME TYPE on HTTP request to upload a php file. The fixed version is: after commit 09f0ab871bf633973cfd9fc4fe59d4a912397cf8."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}]}, "references": {"reference_data": [{"name": "https://github.com/pluck-cms/pluck/commit/09f0ab871bf633973cfd9fc4fe59d4a912397cf8", "refsource": "MISC", "url": "https://github.com/pluck-cms/pluck/commit/09f0ab871bf633973cfd9fc4fe59d4a912397cf8"}, {"name": "https://github.com/pluck-cms/pluck/issues/44", "refsource": "MISC", "url": "https://github.com/pluck-cms/pluck/issues/44"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T03:07:18.171Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/pluck-cms/pluck/commit/09f0ab871bf633973cfd9fc4fe59d4a912397cf8"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/pluck-cms/pluck/issues/44"}]}]}, "cveMetadata": {"assignerOrgId": "7556d962-6fb7-411e-85fa-6cd62f095ba8", "assignerShortName": "dwf", "cveId": "CVE-2019-1010062", "datePublished": "2019-07-16T12:24:15", "dateReserved": "2019-03-20T00:00:00", "dateUpdated": "2024-08-05T03:07:18.171Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:pluck-cms:pluckcms:*:*:*:*:*:*:*:*", "matchCriteriaId": "864B3716-962D-4BC2-8A56-E483D47AB4B7", "versionEndIncluding": "4.7.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "PluckCMS 4.7.4 and earlier is affected by: CWE-434 Unrestricted Upload of File with Dangerous Type. The impact is: get webshell. The component is: data/inc/images.php line36. The attack vector is: modify the MIME TYPE on HTTP request to upload a php file. The fixed version is: after commit 09f0ab871bf633973cfd9fc4fe59d4a912397cf8."}, {"lang": "es", "value": "PluckCMS versiones 4.7.4 y anteriores, est\u00e1n afectados por: CWE-434 Carga de Archivos de Tipo Dangerous Sin Restricciones. El impacto es: obtener webshell. El componente es: el archivo data/inc/images.php line36. El vector de ataque es: modificar el TIPO MIME en la petici\u00f3n HTTP para cargar un archivo php. La versi\u00f3n corregida es: despu\u00e9s del commit 09f0ab871bf633973cfd9fc4fe59d4a912397cf8."}], "id": "CVE-2019-1010062", "lastModified": "2024-11-21T04:17:57.210", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "[email protected]", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "[email protected]", "type": "Primary"}]}, "published": "2019-07-16T13:15:11.410", "references": [{"source": "[email protected]", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/pluck-cms/pluck/commit/09f0ab871bf633973cfd9fc4fe59d4a912397cf8"}, {"source": "[email protected]", "tags": ["Third Party Advisory"], "url": "https://github.com/pluck-cms/pluck/issues/44"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/pluck-cms/pluck/commit/09f0ab871bf633973cfd9fc4fe59d4a912397cf8"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/pluck-cms/pluck/issues/44"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "[email protected]", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-434"}], "source": "[email protected]", "type": "Primary"}]}