CVE-2019-19684: Malicious File Upload

Published Dec 9, 2019

Updated

nopCommerce v4.2.0 allows privilege escalation via file upload in Presentation/Nop.Web/Admin/Areas/Controllers/PluginController.cs via Admin/FacebookAuthentication/Configure because it is possible to upload a crafted Facebook Auth plugin.

Affected Software

1 affected component

Nopcommerce NopCommerce=4.20

Event History

Dec 9, 2019

CVE Published

via MITRE·04:58 PM

Data Sourced

via MITRE·04:58 PM

Description

Frequently Asked Questions

What is the severity of CVE-2019-19684?

The severity of CVE-2019-19684 is classified as high due to its potential for privilege escalation.

How do I fix CVE-2019-19684?

To fix CVE-2019-19684, update your nopCommerce installation to version 4.2.1 or later, which resolves the file upload vulnerability.

What versions of nopCommerce are affected by CVE-2019-19684?

CVE-2019-19684 affects nopCommerce version 4.2.0.

What is the impact of CVE-2019-19684?

The impact of CVE-2019-19684 allows unauthorized users to gain higher privileges through malicious file uploads.

Is there a workaround for CVE-2019-19684?

Yes, a potential workaround for CVE-2019-19684 is to disable the Facebook Authentication plugin to prevent unauthorized access.