CVE-2019-19502

CRITICAL

9.8

Description

Code injection in pluginconfig.php in Image Uploader and Browser for CKEditor before 4.1.9 allows remote authenticated users to execute arbitrary PHP code.

CVE Details

CVSS v3.1 Score9.8

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published12/2/2019

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

maleck:image_uploader_and_browser_for_ckeditor

Weaknesses (CWE)

CWE-94

References

https://github.com/xsmo/Image-Uploader-and-Browser-for-CKEditor/commit/c293d38c8b99444e775d94c1af50c9676c6544d2(cve@mitre.org)

https://github.com/xsmo/Image-Uploader-and-Browser-for-CKEditor/compare/4.1.8...v4.1.9(cve@mitre.org)

https://github.com/xsmo/Image-Uploader-and-Browser-for-CKEditor/pull/11(cve@mitre.org)

https://github.com/xsmo/Image-Uploader-and-Browser-for-CKEditor/pull/11/commits/5c7a6b0e10504f08e2f50655541b767e276ce749(cve@mitre.org)

https://visat.me/security/cve-2019-19502/(cve@mitre.org)

https://github.com/xsmo/Image-Uploader-and-Browser-for-CKEditor/commit/c293d38c8b99444e775d94c1af50c9676c6544d2(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/xsmo/Image-Uploader-and-Browser-for-CKEditor/compare/4.1.8...v4.1.9(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/xsmo/Image-Uploader-and-Browser-for-CKEditor/pull/11(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/xsmo/Image-Uploader-and-Browser-for-CKEditor/pull/11/commits/5c7a6b0e10504f08e2f50655541b767e276ce749(af854a3a-2127-422b-91ae-364da2661108)

https://visat.me/security/cve-2019-19502/(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.