CVE-2018-19135

ClipperCMS 1.3.3 does not have CSRF protection on its kcfinder file upload (enabled by default). This can be used by an attacker to perform actions for an admin (or any user with the file upload capability). With this vulnerability, one can automatically upload files (by default, it allows html, pdf, xml, zip, and many other file types). A file can be accessed publicly under the "/assets/files" directory.

CVSS v3 8.8 HIGH
CVSS v2.0 6.8 MEDIUM

8.8^/10

CVSS v3 : HIGH

Vector : AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/ClipperCMS/ClipperCMS/issues/494	Exploit Issue Tracking Third Party Advisory
https://www.exploit-db.com/exploits/45839/	Exploit Third Party Advisory VDB Entry
https://github.com/ClipperCMS/ClipperCMS/issues/494	Exploit Issue Tracking Third Party Advisory
https://www.exploit-db.com/exploits/45839/	Exploit Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

cpe:2.3:a:clippercms:clippercms:1.3.3:*:*:*:*:*:*:*

History

21 Nov 2024, 03:57

Type	Values Removed	Values Added
References	~~() https://github.com/ClipperCMS/ClipperCMS/issues/494 - Exploit, Issue Tracking, Third Party Advisory~~	() https://github.com/ClipperCMS/ClipperCMS/issues/494 - Exploit, Issue Tracking, Third Party Advisory
References	~~() https://www.exploit-db.com/exploits/45839/ - Exploit, Third Party Advisory, VDB Entry~~	() https://www.exploit-db.com/exploits/45839/ - Exploit, Third Party Advisory, VDB Entry

Information

Published : 2018-11-11 04:29

Updated : 2024-11-21 03:57

NVD link : CVE-2018-19135

Mitre link : CVE-2018-19135

CVE.ORG link : CVE-2018-19135

JSON object : View

Products Affected

clippercms

clippercms

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2018-19135", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2018-11-11T04:29:00.173", "references": [{"url": "https://github.com/ClipperCMS/ClipperCMS/issues/494", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.exploit-db.com/exploits/45839/", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "https://github.com/ClipperCMS/ClipperCMS/issues/494", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.exploit-db.com/exploits/45839/", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "ClipperCMS 1.3.3 does not have CSRF protection on its kcfinder file upload (enabled by default). This can be used by an attacker to perform actions for an admin (or any user with the file upload capability). With this vulnerability, one can automatically upload files (by default, it allows html, pdf, xml, zip, and many other file types). A file can be accessed publicly under the \"/assets/files\" directory."}, {"lang": "es", "value": "ClipperCMS 1.3.3 no tiene protecci\u00f3n contra Cross-Site Request Forgery (CSRF) en la subida de archivos kcfinder (habilitado por defecto). Esto puede ser utilizado por un atacante para realizar acciones para un administrador (o cualquier usuario con la capacidad de subir archivos). Con esta vulnerabilidad, se pueden subir archivos autom\u00e1ticamente (por defecto, permite html, pdf, xml, zip, y muchos otros tipos de archivos). Se puede acceder p\u00fablicamente a un fichero en el directorio \"/assets/files\"."}], "lastModified": "2024-11-21T03:57:24.010", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:clippercms:clippercms:1.3.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C72E4CBC-C990-42AE-86BC-3123A14E5426"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}