CVE-2014-9619: Malicious File Upload
Unrestricted file upload vulnerability in webadmin/ajaxfilemanager/ajaxfilemanager.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote authenticated users with admin privileges on the Cloud Manager web console to execute arbitrary PHP code by uploading a file with a double extension, then accessing it via a direct request to the file in webadmin/deny/images/, as demonstrated by secuid0.php.gif.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-9619?
CVE-2014-9619 is considered a critical vulnerability due to the potential for remote code execution.
How do I fix CVE-2014-9619?
To fix CVE-2014-9619, upgrade Netsweeper to version 3.1.10 or later, 4.0.9 or later, or 4.1.2 or later.
What does CVE-2014-9619 exploit?
CVE-2014-9619 exploits an unrestricted file upload vulnerability that allows authenticated users to execute PHP code.
What affected versions are there for CVE-2014-9619?
The affected versions for CVE-2014-9619 include Netsweeper versions prior to 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2.
Who is vulnerable to CVE-2014-9619?
Remote authenticated users with admin privileges on the Cloud Manager web console are vulnerable to CVE-2014-9619.