CVE-2019-19685: CSRF
Published Dec 9, 2019
·Updated
RoxyFileman, as shipped with nopCommerce v4.2.0, is vulnerable to CSRF because GET requests can be used for renames and deletions.
Affected Software
1 affected component
Nopcommerce NopCommerce=4.20
Event History
Dec 9, 2019
CVE Published
via MITRE·04:58 PM
Data Sourced
via MITRE·04:58 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2019-19685?
CVE-2019-19685 is classified as a high severity vulnerability due to the potential for unauthorized file manipulation.
2
How do I fix CVE-2019-19685?
Fix CVE-2019-19685 by updating to the latest version of nopCommerce that has addressed the CSRF vulnerabilities.
3
What type of vulnerability is CVE-2019-19685?
CVE-2019-19685 is a Cross-Site Request Forgery (CSRF) vulnerability.
4
Who is affected by CVE-2019-19685?
Users of nopCommerce version 4.2.0 are affected by CVE-2019-19685.
5
What actions can be exploited in CVE-2019-19685?
CVE-2019-19685 allows attackers to exploit GET requests to rename and delete files.