CVE-2019-11401

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2019-11401
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-11401.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2019-11401
Aliases
Published
2019-04-22T11:29:04.313Z
Modified
2026-08-07T14:49:58.216315Z
Severity
  • 7.2 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

A issue was discovered in SiteServer CMS 6.9.0. It allows remote attackers to execute arbitrary code because an administrator can add the permitted file extension .aassp, which is converted to .asp because the "as" substring is deleted.

References

Affected packages

Git / github.com/siteserver/cms

Affected ranges

Type
GIT
Repo
https://github.com/siteserver/cms
Events
Introduced
5e04df46b9d73fa75189c93ba58521023129fca7
Last affected
5e04df46b9d73fa75189c93ba58521023129fca7
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:siteserver:siteserver_cms:6.9.0:*:*:*:*:*:*:*",
    "source": "CPE_STRING",
    "extracted_events": [
        {
            "introduced": "6.9.0"
        },
        {
            "last_affected": "6.9.0"
        }
    ]
}

Affected versions

6.*
6.9.0
siteserver-v6.*
siteserver-v6.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-11401.json"