What is CVE-2019-17575?

CVE-2019-17575 is a high-severity vulnerability in Wbce Cms, classified under Use of Incorrectly-Resolved Name or Reference. CVSS score: 7.2/10. Published 2019-10-14.

How severe is CVE-2019-17575?

High severity. CVSS v3 base score is 7.2 out of 10.

Vulnerability in Wbce Cms

CVE-2019-17575

A file-rename filter bypass exists in admin/media/rename.php in WBCE CMS 1.4.0 and earlier. This can be exploited by an authenticated user with admin privileges to rename a media filename and extension. (For example: place PHP code in a .jpg file, and then change the file's base name to filename.ph and change the file's extension to p. Because of concatenation, the name is then treated as filename.php.) At the result, remote attackers can execute arbitrary PHP code.

EPSS: 0.014 (70.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

Affected products

Wbce Wbce_cms
N/a — versions n/a

Weakness classification (CWE)

CWE-706 — Use of Incorrectly-Resolved Name or Reference

References

cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2019-17575?: CVE-2019-17575 is a high-severity vulnerability in Wbce Cms, classified under Use of Incorrectly-Resolved Name or Reference. CVSS score: 7.2/10. Published 2019-10-14.
How severe is CVE-2019-17575?: High severity. CVSS v3 base score is 7.2 out of 10.