Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXI1Z20tNHA1dy1wcTJw

Remote code execution in verot/class.upload.php

class.upload.php in verot.net class.upload before 1.0.3 and 2.x before 2.0.4, as used in the K2 extension for Joomla! and other products, omits .phar from the set of dangerous file extensions.

Permalink: https://github.com/advisories/GHSA-r5gm-4p5w-pq2p
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXI1Z20tNHA1dy1wcTJw
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: over 4 years ago
Updated: over 1 year ago

CVSS Score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-r5gm-4p5w-pq2p, CVE-2019-19576
References:

• https://nvd.nist.gov/vuln/detail/CVE-2019-19576
• https://github.com/getk2/k2/commit/d1344706c4b74c2ae7659b286b5a066117155124
• https://github.com/verot/class.upload.php/commit/5a7505ddec956fdc9e9c071ae5089865559174f1
• https://github.com/verot/class.upload.php/commit/db1b4fe50c1754696970d8b437f07e7b94a7ebf2
• https://github.com/jra89/CVE-2019-19576
• https://github.com/verot/class.upload.php/compare/1.0.2...1.0.3
• https://github.com/verot/class.upload.php/compare/2.0.3...2.0.4
• https://medium.com/@jra8908/cve-2019-19576-e9da712b779
• https://www.verot.net
• https://www.verot.net/php_class_upload.htm
• http://packetstormsecurity.com/files/155577/Verot-2.0.3-Remote-Code-Execution.html
• https://github.com/advisories/GHSA-r5gm-4p5w-pq2p

Repository: https://github.com/getk2/k2
Blast Radius: 20.7

Affected Packages