CVE-2019-18643
Last modified
CVE-2019-18643 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Rock RMS versions before 8.10 and versions 9.0 through 9.3 fails to properly validate files uploaded in the application. The only protection mechanism is a file-extension blacklist that can be bypassed by adding multiple spaces and periods after the file name. EPSS estimates a 4.10% chance of exploitation in the next 30 days.
Description
Rock RMS versions before 8.10 and versions 9.0 through 9.3 fails to properly validate files uploaded in the application. The only protection mechanism is a file-extension blacklist that can be bypassed by adding multiple spaces and periods after the file name. This could allow an attacker to upload ASPX code and gain remote code execution on the application. The application typically runs as LocalSystem as mandated in the installation guide. Patched in versions 8.10 and 9.4.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Sparkdevnetwork | Rock Rms | < 8.10 |
| Sparkdevnetwork | Rock Rms | >= 9.0, < 9.4 |
References
- http://packetstormsecurity.com/files/160766/Rock-RMS-File-Upload-Account-Takeover-Information-Disclosure.htmlThird Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/160766/Rock-RMS-File-Upload-Account-Takeover-Information-Disclosure.htmlThird Party Advisory, VDB Entry
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-18643?
How severe is CVE-2019-18643?
How do I fix CVE-2019-18643?
Are you affected by CVE-2019-18643?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST