CVE-2019-12739: OS Command Injection
Published Jun 5, 2019
·Updated
lib/Controller/ExtractionController.php in the Extract add-on before 1.2.0 for Nextcloud allows Remote Code Execution via shell metacharacters in a RAR filename via ajax/extractRar.php (nameOfFile and directory parameters).
Affected Software
1 affected component
Nextcloud Extract Nextcloud<1.2.0
Event History
Jun 5, 2019
CVE Published
via MITRE·01:57 PM
Data Sourced
via MITRE·01:57 PM
DescriptionSeverity
Frequently Asked Questions
1
What is the severity of CVE-2019-12739?
CVE-2019-12739 is considered a critical vulnerability due to its potential for Remote Code Execution.
2
How do I fix CVE-2019-12739?
To mitigate CVE-2019-12739, users should upgrade to the Extract add-on version 1.2.0 or later for Nextcloud.
3
What systems are affected by CVE-2019-12739?
CVE-2019-12739 affects the Extract add-on for Nextcloud versions prior to 1.2.0.
4
What type of vulnerability is CVE-2019-12739?
CVE-2019-12739 is a Remote Code Execution vulnerability that allows attackers to execute arbitrary code.
5
Can CVE-2019-12739 be exploited remotely?
Yes, CVE-2019-12739 can be exploited remotely via specially crafted RAR filenames.