CVE-2019-9185 - Vulnerability Details - OpenCVE

Controller/Async/FilesystemManager.php in the filemanager in Bolt before 3.6.5 allows remote attackers to execute arbitrary PHP code by renaming a previously uploaded file to have a .php extension.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Boltcms	Bolt

Configuration 1 [-]

cpe:2.3:a:boltcms:bolt:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/bolt/bolt/blob/v3.6.5/changelog.md
https://github.com/bolt/bolt/pull/7745
https://github.com/bolt/bolt/releases/tag/v3.6.5
https://www.hacksecproject.com/?p=293

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2019-03-07T22:00:00

Updated: 2024-08-04T21:38:46.626Z

Reserved: 2019-02-26T00:00:00

Link: CVE-2019-9185

Vulnrichment

No data.

NVD

Status : Modified

Published: 2019-03-07T23:29:02.097

Modified: 2024-11-21T04:51:09.833

Link: CVE-2019-9185

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2019-02-26T00:00:00", "descriptions": [{"lang": "en", "value": "Controller/Async/FilesystemManager.php in the filemanager in Bolt before 3.6.5 allows remote attackers to execute arbitrary PHP code by renaming a previously uploaded file to have a .php extension."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-03-26T15:47:51", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://github.com/bolt/bolt/releases/tag/v3.6.5"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/bolt/bolt/pull/7745"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/bolt/bolt/blob/v3.6.5/changelog.md"}, {"tags": ["x_refsource_MISC"], "url": "https://www.hacksecproject.com/?p=293"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2019-9185", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Controller/Async/FilesystemManager.php in the filemanager in Bolt before 3.6.5 allows remote attackers to execute arbitrary PHP code by renaming a previously uploaded file to have a .php extension."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://github.com/bolt/bolt/releases/tag/v3.6.5", "refsource": "MISC", "url": "https://github.com/bolt/bolt/releases/tag/v3.6.5"}, {"name": "https://github.com/bolt/bolt/pull/7745", "refsource": "MISC", "url": "https://github.com/bolt/bolt/pull/7745"}, {"name": "https://github.com/bolt/bolt/blob/v3.6.5/changelog.md", "refsource": "MISC", "url": "https://github.com/bolt/bolt/blob/v3.6.5/changelog.md"}, {"name": "https://www.hacksecproject.com/?p=293", "refsource": "MISC", "url": "https://www.hacksecproject.com/?p=293"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T21:38:46.626Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/bolt/bolt/releases/tag/v3.6.5"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/bolt/bolt/pull/7745"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/bolt/bolt/blob/v3.6.5/changelog.md"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.hacksecproject.com/?p=293"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2019-9185", "datePublished": "2019-03-07T22:00:00", "dateReserved": "2019-02-26T00:00:00", "dateUpdated": "2024-08-04T21:38:46.626Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:boltcms:bolt:*:*:*:*:*:*:*:*", "matchCriteriaId": "CCE5F0BA-056D-4C22-8B05-DE47ED634384", "versionEndExcluding": "3.6.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Controller/Async/FilesystemManager.php in the filemanager in Bolt before 3.6.5 allows remote attackers to execute arbitrary PHP code by renaming a previously uploaded file to have a .php extension."}, {"lang": "es", "value": "Controller/Async/FilesystemManager.php en el gestor de archivos en Bolt, en versiones 3.6.5 y anteriores, permite a los atacantes remotos ejecutar c\u00f3digo PHP arbitrario renombrando un archivo previamente subido para que tenga una extensi\u00f3n .php."}], "id": "CVE-2019-9185", "lastModified": "2024-11-21T04:51:09.833", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-03-07T23:29:02.097", "references": [{"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://github.com/bolt/bolt/blob/v3.6.5/changelog.md"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://github.com/bolt/bolt/pull/7745"}, {"source": "cve@mitre.org", "tags": ["Patch", "Release Notes", "Third Party Advisory"], "url": "https://github.com/bolt/bolt/releases/tag/v3.6.5"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.hacksecproject.com/?p=293"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/bolt/bolt/blob/v3.6.5/changelog.md"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/bolt/bolt/pull/7745"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Release Notes", "Third Party Advisory"], "url": "https://github.com/bolt/bolt/releases/tag/v3.6.5"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.hacksecproject.com/?p=293"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "nvd@nist.gov", "type": "Primary"}]}