Recent Vulnerabilities Research Posts Trends Blog About Contact

Published: 14/09/2019 Updated: 17/09/2019

CVSS v2 Base Score: 6.5 | Impact Score: 6.4 | Exploitability Score: 8

CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8

VMScore: 578

Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P

In Pimcore prior to 5.7.1, an attacker with limited privileges can trigger execution of a .phar file via a phar:// URL in a filename parameter, because PHAR uploads are not blocked and are reachable within the phar://../../../../../../../../var/www/html/web/var/assets/ directory, a different vulnerability than CVE-2019-10867 and CVE-2019-16318.

Vulnerable Product	Search on Vulmon	Subscribe to Product
pimcore pimcore

CWE-502 https://github.com/pimcore/pimcore/commit/6ee5d8536d0802e377594cbe39083e822710aab9 https://snyk.io/vuln/SNYK-PHP-PIMCOREPIMCORE-451599 https://nvd.nist.gov

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2019-16317

Vulnerability Summary

Vulnerability Trend

References

Vulmon Search

About

Products

Connect