CVE-2019-9616

An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider (for example) file.jsp::$DATA to the admin/ueditor/uploadScrawl URI.

Score

CVSS 3.0 7.2 High

Status

Modified - cve@mitre.org

Published

2019-03-06

Last modified

2024-09-16

Weaknesses

CWE-706

Affected products

• Ofcms (Ofcms Project)

References

• https://www.seebug.org/vuldb/ssvid-97833