CVE-2019-11401: Malicious File Upload
A issue was discovered in SiteServer CMS 6.9.0. It allows remote attackers to execute arbitrary code because an administrator can add the permitted file extension .aassp, which is converted to .asp because the "as" substring is deleted.
Other sources
A issue was discovered in SiteServer CMS prior to version 6.12. It allows remote attackers to execute arbitrary code because an administrator can add the permitted file extension .aassp, which is converted to .asp because the "as" substring is deleted.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-11401?
CVE-2019-11401 is rated as critical due to its potential for remote code execution.
How do I fix CVE-2019-11401?
To fix CVE-2019-11401, upgrade SiteServer CMS to version 6.12 or later.
What software versions are affected by CVE-2019-11401?
CVE-2019-11401 affects SiteServer CMS versions prior to 6.12, specifically version 6.9.0.
What type of vulnerability is CVE-2019-11401?
CVE-2019-11401 is a remote code execution vulnerability that allows attackers to execute arbitrary code.
Can CVE-2019-11401 be exploited remotely?
Yes, CVE-2019-11401 can be exploited remotely by attackers to execute malicious code.