Vulnerability Description
Unrestricted file upload vulnerability in webadmin/ajaxfilemanager/ajaxfilemanager.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote authenticated users with admin privileges on the Cloud Manager web console to execute arbitrary PHP code by uploading a file with a double extension, then accessing it via a direct request to the file in webadmin/deny/images/, as demonstrated by secuid0.php.gif.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Netsweeper | Netsweeper | <= 3.1.9 |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/133034/Netsweeper-Bypass-XSS-Redirection-SQThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/37932/Third Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/133034/Netsweeper-Bypass-XSS-Redirection-SQThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/37932/Third Party AdvisoryVDB Entry
FAQ
What is CVE-2014-9619?
CVE-2014-9619 is a vulnerability with a CVSS score of 7.2 (HIGH). Unrestricted file upload vulnerability in webadmin/ajaxfilemanager/ajaxfilemanager.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote authenticated users with ad...
How severe is CVE-2014-9619?
CVE-2014-9619 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2014-9619?
Check the references section above for vendor advisories and patch information. Affected products include: Netsweeper Netsweeper.