CVE-2019-13979: Malicious File Upload
Published Jul 19, 2019
·Updated
In Directus 7 API before 2.2.1, uploading of PHP files is not blocked, leading to uploads//originals remote code execution.
Affected Software
1 affected component
Rangerstudio Directus 7 Api<2.2.1
Event History
Jul 19, 2019
CVE Published
via MITRE·02:18 PM
Data Sourced
via MITRE·02:18 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2019-13979?
CVE-2019-13979 has a critical severity due to the potential for remote code execution.
2
How do I fix CVE-2019-13979?
To fix CVE-2019-13979, upgrade Directus 7 API to version 2.2.1 or later.
3
What platforms are affected by CVE-2019-13979?
CVE-2019-13979 affects all versions of Directus 7 API prior to 2.2.1.
4
Why is CVE-2019-13979 a concern for developers?
CVE-2019-13979 is a concern for developers because it allows an attacker to upload malicious PHP files, leading to remote code execution.
5
What are the implications of not addressing CVE-2019-13979?
Failing to address CVE-2019-13979 can result in unauthorized access and full control over the server hosting Directus.