CVE-2019-19576: Malicious File Upload
class.upload.php in verot.net class.upload before 1.0.3 and 2.x before 2.0.4, as used in the K2 extension for Joomla! and other products, omits .phar from the set of dangerous file extensions.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2019-19576?
The severity of CVE-2019-19576 is critical with a CVSS score of 9.8.
Which software versions are affected by CVE-2019-19576?
Versions before 1.0.3 of Verot Project Verot and versions between 2.0.0 and 2.0.4 of Verot Project Verot are affected by CVE-2019-19576. Additionally, versions up to and including 2.10.1 of Getk2 K2 are also affected.
What is the vulnerability of CVE-2019-19576?
CVE-2019-19576 is a remote code execution vulnerability in class.upload.php, which is used in the K2 extension for Joomla! and other products.
How can I fix CVE-2019-19576?
To fix CVE-2019-19576, you should update to version 1.0.3 for Verot Project Verot, update to a version higher than 2.0.4 for Verot Project Verot, or update to a version higher than 2.10.1 for Getk2 K2.
Where can I find more information about CVE-2019-19576?
You can find more information about CVE-2019-19576 at the following references: http://packetstormsecurity.com/files/155577/Verot-2.0.3-Remote-Code-Execution.html, https://github.com/getk2/k2/commit/d1344706c4b74c2ae7659b286b5a066117155124, https://github.com/jra89/CVE-2019-19576.