What is GHSA-ff4w-8chr-w2x9?

GHSA-ff4w-8chr-w2x9 is a security advisory published by GitHub Security Advisories with High severity. SiteServer CMS RCE via unsafe file upload

Which CVE IDs does GHSA-ff4w-8chr-w2x9 cover?

GHSA-ff4w-8chr-w2x9 covers the following CVE IDs: CVE-2019-11401. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-ff4w-8chr-w2x9?

GHSA-ff4w-8chr-w2x9 has a CVSS v3 base score of 7.2, published by GitHub Security Advisories.

Which products are affected by GHSA-ff4w-8chr-w2x9?

GHSA-ff4w-8chr-w2x9 affects 1 product, including: nuget/sscms:\u003c 6.12.

GHSA-ff4w-8chr-w2x9HighCVSS 7.2

SiteServer CMS RCE via unsafe file upload

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

August 25, 2023

🔗 CVE IDs covered (1)

CVE-2019-11401 →

📋 Description

A issue was discovered in SiteServer CMS prior to version 6.12. It allows remote attackers to execute arbitrary code because an administrator can add the permitted file extension .aassp, which is converted to .asp because the "as" substring is deleted.

🎯 Affected products1

nuget/sscms:< 6.12

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2019-11401
https://github.com/siteserver/cms/issues/1858
https://github.com/siteserver/cms/commit/a7edb9ce3f9b52be3d18fa8a0e44931264e22436#diff-c8a06aaffb97eb2f4c587c1786906edd49dea574d063f74a59d9653ee0d5718b
https://github.com/advisories/GHSA-ff4w-8chr-w2x9