CVE-2019-19374

An issue was discovered in core/assets/form/form_question_types/form_question_type_file_upload/form_question_type_file_upload.inc in Squiz Matrix CMS 5.5.0 prior to 5.5.0.3, 5.5.1 prior to 5.5.1.8, 5.5.2 prior to 5.5.2.4, and 5.5.3 prior to 5.5.3.3 where a user can delete arbitrary files from the server during interaction with the File Upload field type, when a custom form exists. (This is related to an information disclosure issue within the File Upload field type that allows users to view the full path to uploaded files, including the product's web root directory.)

CVSS v3.0 9.1 CRITICAL
CVSS v2.0 7.5 HIGH

9.1^/10

CVSS v3.0 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://matrix.squiz.net/releases/5.5/5.5.3.3	Release Notes
https://zxsecurity.co.nz/wp-content/uploads/2019/12/ZX%20Security%20Advisory%20-%20Squiz%20Matrix%20CMS%20-%20Multiple%20Vulnerabilities.pdf	Third Party Advisory
http://seclists.org/fulldisclosure/2019/Dec/34	Exploit Mailing List Third Party Advisory
http://packetstormsecurity.com/files/155671/Squiz-Matrix-CMS-5.5.x.x-Code-Execution-Information-Disclosure.html	Exploit Third Party Advisory VDB Entry

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:squiz:matrix::::::::
	cpe:2.3:a:squiz:matrix::::::::
	cpe:2.3:a:squiz:matrix::::::::
	cpe:2.3:a:squiz:matrix::::::::

Information

Published : 2019-12-11 12:15

Updated : 2020-08-24 10:37

NVD link : CVE-2019-19374

Mitre link : CVE-2019-19374

JSON object : View

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Advertisement

Products Affected

squiz

matrix

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://matrix.squiz.net/releases/5.5/5.5.3.3", "name": "https://matrix.squiz.net/releases/5.5/5.5.3.3", "tags": ["Release Notes"], "refsource": "MISC"}, {"url": "https://zxsecurity.co.nz/wp-content/uploads/2019/12/ZX%20Security%20Advisory%20-%20Squiz%20Matrix%20CMS%20-%20Multiple%20Vulnerabilities.pdf", "name": "https://zxsecurity.co.nz/wp-content/uploads/2019/12/ZX%20Security%20Advisory%20-%20Squiz%20Matrix%20CMS%20-%20Multiple%20Vulnerabilities.pdf", "tags": ["Third Party Advisory"], "refsource": "MISC"}, {"url": "http://seclists.org/fulldisclosure/2019/Dec/34", "name": "20191213 Squiz Matrix CMS <= 5.5.3.2 - Multiple Issues may lead to Remote Code Execution", "tags": ["Exploit", "Mailing List", "Third Party Advisory"], "refsource": "FULLDISC"}, {"url": "http://packetstormsecurity.com/files/155671/Squiz-Matrix-CMS-5.5.x.x-Code-Execution-Information-Disclosure.html", "name": "http://packetstormsecurity.com/files/155671/Squiz-Matrix-CMS-5.5.x.x-Code-Execution-Information-Disclosure.html", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "An issue was discovered in core/assets/form/form_question_types/form_question_type_file_upload/form_question_type_file_upload.inc in Squiz Matrix CMS 5.5.0 prior to 5.5.0.3, 5.5.1 prior to 5.5.1.8, 5.5.2 prior to 5.5.2.4, and 5.5.3 prior to 5.5.3.3 where a user can delete arbitrary files from the server during interaction with the File Upload field type, when a custom form exists. (This is related to an information disclosure issue within the File Upload field type that allows users to view the full path to uploaded files, including the product's web root directory.)"}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-22"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2019-19374", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "HIGH", "acInsufInfo": false, "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}}, "publishedDate": "2019-12-11T20:15Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:squiz:matrix:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "5.5.0.3", "versionStartIncluding": "5.5.0.0"}, {"cpe23Uri": "cpe:2.3:a:squiz:matrix:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "5.5.1.8", "versionStartIncluding": "5.5.1.0"}, {"cpe23Uri": "cpe:2.3:a:squiz:matrix:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "5.5.2.4", "versionStartIncluding": "5.5.2.0"}, {"cpe23Uri": "cpe:2.3:a:squiz:matrix:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "5.5.3.3", "versionStartIncluding": "5.5.3.0"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2020-08-24T17:37Z"}