CVE-2019-12169: Path Traversal
ATutor 2.2.4 allows Arbitrary File Upload and Directory Traversal, resulting in remote code execution via a ".." pathname in a ZIP archive to the mods/core/languages/languageimport.php (aka Import New Language) or mods/standard/patcher/indexadmin.php (aka Patcher) component.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-12169?
CVE-2019-12169 is considered a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2019-12169?
To fix CVE-2019-12169, upgrade to a version of ATutor that is later than 2.2.4.
What types of attacks are possible with CVE-2019-12169?
CVE-2019-12169 allows attackers to perform arbitrary file uploads and directory traversal attacks.
Which components of ATutor are affected by CVE-2019-12169?
CVE-2019-12169 affects the language_import.php and index_admin.php components of ATutor.
Is CVE-2019-12169 easy to exploit?
Exploiting CVE-2019-12169 is relatively straightforward due to the flawed file upload functionality and lack of validation.