ByteOS Network

NVD Vulnerability Details :

CVE-2019-19576

Modified

Source-cve@mitre.org

Published At-04 Dec, 2019 | 18:15

Updated At-07 Nov, 2023 | 03:07

class.upload.php in verot.net class.upload before 1.0.3 and 2.x before 2.0.4, as used in the K2 extension for Joomla! and other products, omits .phar from the set of dangerous file extensions.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary	2.0	7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P

CPE Matches

verot_project>>verot>>Versions before 1.0.3(exclusive)

cpe:2.3:a:verot_project:verot:*:*:*:*:*:*:*:*

verot_project>>verot>>Versions from 2.0.0(inclusive) to 2.0.4(exclusive)

cpe:2.3:a:verot_project:verot:*:*:*:*:*:*:*:*

getk2>>k2>>Versions up to 2.10.1(inclusive)

cpe:2.3:a:getk2:k2:*:*:*:*:*:joomla\!:*:*

Weaknesses

CWE ID	Type	Source
CWE-434	Primary	nvd@nist.gov

References

Hyperlink	Source	Resource
http://packetstormsecurity.com/files/155577/Verot-2.0.3-Remote-Code-Execution.html	cve@mitre.org	Exploit Third Party Advisory VDB Entry
https://github.com/getk2/k2/commit/d1344706c4b74c2ae7659b286b5a066117155124	cve@mitre.org	Patch Third Party Advisory
https://github.com/jra89/CVE-2019-19576	cve@mitre.org	Exploit Third Party Advisory
https://github.com/verot/class.upload.php/commit/5a7505ddec956fdc9e9c071ae5089865559174f1	cve@mitre.org	Patch Third Party Advisory
https://github.com/verot/class.upload.php/commit/db1b4fe50c1754696970d8b437f07e7b94a7ebf2	cve@mitre.org	Patch Third Party Advisory
https://github.com/verot/class.upload.php/compare/1.0.2...1.0.3	cve@mitre.org	Patch Third Party Advisory
https://github.com/verot/class.upload.php/compare/2.0.3...2.0.4	cve@mitre.org	Patch Third Party Advisory
https://medium.com/%40jra8908/cve-2019-19576-e9da712b779	cve@mitre.org	N/A
https://www.verot.net	cve@mitre.org	Product
https://www.verot.net/php_class_upload.htm	cve@mitre.org	Vendor Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History