#VU23781 Input validation error in Squiz Matrix - CVE-2019-19374

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU23781

#VU23781 Input validation error in Squiz Matrix - CVE-2019-19374

Published: December 20, 2019


Vulnerability identifier: #VU23781
Vulnerability risk: High
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2019-19374
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vulnerable software:
Squiz Matrix
Software vendor:
Squiz.net

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to insufficient validation of user-supplied input in "core/assets/form/form_question_types/form_question_type_file_upload/form_question_type_file_upload.inc". A remote attacker can delete arbitrary files from the server during interaction with the File Upload field type, when a custom form exists.

Note: This is related to an information disclosure issue within the File Upload field type that allows attackers to view the full path to uploaded files, including the product's web root directory.


Remediation

Install updates from vendor's website.

External links