Input validation error in Squiz Matrix - CVE-2019-19374

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU23781

Input validation error in Squiz Matrix - CVE-2019-19374

Published: December 20, 2019


Vulnerability identifier: #VU23781
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2019-19374
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vendor: Squiz.net
Affected software:
Squiz Matrix

Detailed vulnerability description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to insufficient validation of user-supplied input in "core/assets/form/form_question_types/form_question_type_file_upload/form_question_type_file_upload.inc". A remote attacker can delete arbitrary files from the server during interaction with the File Upload field type, when a custom form exists.

Note: This is related to an information disclosure issue within the File Upload field type that allows attackers to view the full path to uploaded files, including the product's web root directory.


How to mitigate CVE-2019-19374

Install updates from vendor's website.

Sources