CVE-2019-16318: Malicious File Upload
Published Sep 14, 2019
·Updated
In Pimcore before 5.7.1, an attacker with limited privileges can bypass file-extension restrictions via a 256-character filename, as demonstrated by the failure of automatic renaming of .php to .php.txt for long filenames, a different vulnerability than CVE-2019-10867 and CVE-2019-16317.
Affected Software
2 affected componentsFixes available
composer/pimcore/pimcore<5.7.1
5.7.1
Pimcore pimcore<5.7.1
Remediation
Event History
Sep 14, 2019
CVE Published
via MITRE·05:01 PM
Data Sourced
via MITRE·05:01 PM
Description
May 24, 2022
Advisory Published
via GitHub·04:56 PM
Frequently Asked Questions
1
What is the severity of CVE-2019-16318?
CVE-2019-16318 is classified as a medium severity vulnerability.
2
How do I fix CVE-2019-16318?
To fix CVE-2019-16318, upgrade Pimcore to version 5.7.1 or later.
3
Who is affected by CVE-2019-16318?
CVE-2019-16318 affects users of Pimcore versions prior to 5.7.1.
4
What type of vulnerability is CVE-2019-16318?
CVE-2019-16318 is a file extension restriction bypass vulnerability.
5
What are the potential risks of CVE-2019-16318?
The potential risks of CVE-2019-16318 include unauthorized execution of PHP scripts.