CVE-2019-12150 - Karamasoft UltimateEditor 1 does not ensure that an uploaded file is an image or document (neither file types nor extensions are restricted)

Back Back to CVE browser

CRITICAL

Karamasoft UltimateEditor 1 does not ensure that an uploaded file is an image or document (neither file types nor extensions are restricted)

Published May 24, 2019

9.8

CRITICAL

CVSS 3.0

EPSS 1.73%

Description

Karamasoft UltimateEditor 1 does not ensure that an uploaded file is an image or document (neither file types nor extensions are restricted). The attacker must use the Attach icon to perform an upload. An uploaded file is accessible under the UltimateEditorInclude/UserFiles/ URI.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-434

Unrestricted Upload of File

References (2)

https://github.com/Gr4y21/My-CVE-IDs/blob/master/CVE-2019-12150/Karamasoft%20Arbitrary%20File%20Upload
x_refsource_MISCExploitThird Party Advisory
https://www.karamasoft.com
x_refsource_MISCProductVendor Advisory

Link	Providers	Tags
https://github.com/Gr4y21/My-CVE-IDs/blob/master/CVE-2019-12150/Karamasoft%20Arbitrary%20File%20Upload		x_refsource_MISCExploitThird Party Advisory
https://www.karamasoft.com		x_refsource_MISCProductVendor Advisory