CVE-2019-11445: Malicious File Upload
OpenKM 6.3.2 through 6.3.7 allows an attacker to upload a malicious JSP file into the /okm:root directories and move that file to the home directory of the site, via frontend/FileUpload and admin/repositoryexport.jsp. This is achieved by interfering with the Filesystem path control in the admin's Export field. As a result, attackers can gain remote code execution through the application server with root privileges.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-11445?
CVE-2019-11445 is considered to have a high severity due to its ability to allow an attacker to upload malicious files.
How do I fix CVE-2019-11445?
To fix CVE-2019-11445, upgrade OpenKM to version 6.3.8 or later, which addresses this vulnerability.
What versions of OpenKM are affected by CVE-2019-11445?
CVE-2019-11445 affects OpenKM versions 6.3.2 through 6.3.7.
Can CVE-2019-11445 lead to remote command execution?
Yes, CVE-2019-11445 can lead to remote command execution due to unauthorized file uploads.
What is the nature of the vulnerability described in CVE-2019-11445?
CVE-2019-11445 is a file upload vulnerability that allows attackers to manipulate filesystem paths.