Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTJnYzctdzRody1ycjJt

class.upload.php in verot.net omits .pht from the set of dangerous file extensions

class.upload.php in verot.net class.upload through 1.0.3 and 2.x through 2.0.4, as used in the K2 extension for Joomla! and other products, omits .pht from the set of dangerous file extensions, a similar issue to CVE-2019-19576.

Permalink: https://github.com/advisories/GHSA-2gc7-w4hw-rr2m
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTJnYzctdzRody1ycjJt
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: about 4 years ago
Updated: over 1 year ago

CVSS Score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-2gc7-w4hw-rr2m, CVE-2019-19634
References:

• https://nvd.nist.gov/vuln/detail/CVE-2019-19634
• https://github.com/jra89/CVE-2019-19634
• https://github.com/verot/class.upload.php/blob/2.0.4/src/class.upload.php#L3068
• https://medium.com/@jra8908/cve-2019-19634-arbitrary-file-upload-in-class-upload-php-ccaf9e13875e
• https://github.com/advisories/GHSA-2gc7-w4hw-rr2m

Repository: https://github.com/jra89/CVE-2019-19634
Blast Radius: 20.7

Affected Packages