What is CVE-2018-19135?

CVE-2018-19135 is a high-severity vulnerability in Clippercms, classified under Cross-Site Request Forgery (CSRF). CVSS score: 8.8/10. Published 2018-11-11.

How severe is CVE-2018-19135?

High severity. CVSS v3 base score is 8.8 out of 10.

CSRF in Clippercms

CVE-2018-19135

ClipperCMS 1.3.3 does not have CSRF protection on its kcfinder file upload (enabled by default). This can be used by an attacker to perform actions for an admin (or any user with the file upload capability). With this vulnerability, one can automatically upload files (by default, it allows html, pdf, xml, zip, and many other file types). A file can be accessed publicly under the "/assets/files" directory.

Vulnerability class: CSRF (Cross-Site Request Forgery)

EPSS: 0.030 (85.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Affected products

Clippercms — versions 1.3.3
N/a — versions n/a

Weakness classification (CWE)

CWE-352 — Cross-Site Request Forgery (CSRF)

References

cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC, Issue Tracking)
cve@mitre.org (Exploit, VDB Entry, Third Party Advisory, exploit, x_refsource_EXPLOIT-DB)

Frequently asked questions

What is CVE-2018-19135?: CVE-2018-19135 is a high-severity vulnerability in Clippercms, classified under Cross-Site Request Forgery (CSRF). CVSS score: 8.8/10. Published 2018-11-11.
How severe is CVE-2018-19135?: High severity. CVSS v3 base score is 8.8 out of 10.