CVE-2019-11445

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2019-11445

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-11445.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2019-11445

Published

2019-04-22T11:29:05.923Z

Modified

2026-07-08T20:16:10.170760Z

Severity

7.2 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

OpenKM 6.3.2 through 6.3.7 allows an attacker to upload a malicious JSP file into the /okm:root directories and move that file to the home directory of the site, via frontend/FileUpload and admin/repository_export.jsp. This is achieved by interfering with the Filesystem path control in the admin's Export field. As a result, attackers can gain remote code execution through the application server with root privileges.

References

Affected packages

Git / github.com/openkm/document-management-system

Affected ranges

Type

GIT

Repo

https://github.com/openkm/document-management-system

Events

Introduced

Fixed

3fc09ed828680c48d5a133fd6becbf7cd8c447b2

Database specific

{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:openkm:openkm:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "6.3.7"
        }
    ]
}

Affected versions

v6.*

v6.3.3

v6.3.5

v6.3.6

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-11445.json"