CVE-2019-9608

An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider (for example) file.jsp::$DATA to the admin/ueditor/uploadImage URI.

Score

CVSS 3.0 8.8 High

Status

Modified - cve@mitre.org

Published

2019-03-06

Last modified

2024-09-16

Weaknesses

CWE-434

Affected products

• Ofcms (Ofcms Project)

References

• https://www.seebug.org/vuldb/ssvid-97832