CVE-2018-19586: Path Traversal
Silverpeas 5.15 through 6.0.2 is affected by an authenticated Directory Traversal vulnerability that can be triggered during file uploads because core/webapi/upload/FileUploadData.java mishandles a StringUtil.java call. This vulnerability enables regular users to write arbitrary files on the underlying system with privileges of the user running the application. Especially, an attacker may leverage the vulnerability to write an executable JSP file in an exposed web directory to execute commands on the underlying system.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2018-19586?
CVE-2018-19586 has a medium severity rating due to its potential for unauthorized file uploads by authenticated users.
How do I fix CVE-2018-19586?
To fix CVE-2018-19586, update Silverpeas to a version higher than 6.0.2 that has addressed this vulnerability.
Who is affected by CVE-2018-19586?
CVE-2018-19586 affects all versions of Silverpeas from 5.15 to 6.0.2.
What type of vulnerability is CVE-2018-19586?
CVE-2018-19586 is an authenticated Directory Traversal vulnerability that occurs during file uploads.
Can an attacker exploit CVE-2018-19586 without authentication?
No, an attacker must be an authenticated user to exploit CVE-2018-19586.