Vulnerability Description
An issue was discovered in TitanHQ WebTitan before 5.18. In the administration web interface it is possible to upload a crafted backup file that enables an attacker to execute arbitrary code by overwriting existing files or adding new PHP files under the web root. This requires the attacker to have access to a valid web interface account.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Titanhq | Webtitan | < 5.18 |
Related Weaknesses (CWE)
References
- https://write-up.github.io/webtitan/ExploitThird Party Advisory
- https://www.webtitan.com/resources/product-updates/Release NotesVendor Advisory
- https://write-up.github.io/webtitan/ExploitThird Party Advisory
- https://www.webtitan.com/resources/product-updates/Release NotesVendor Advisory
FAQ
What is CVE-2019-19020?
CVE-2019-19020 is a vulnerability with a CVSS score of 7.2 (HIGH). An issue was discovered in TitanHQ WebTitan before 5.18. In the administration web interface it is possible to upload a crafted backup file that enables an attacker to execute arbitrary code by overwr...
How severe is CVE-2019-19020?
CVE-2019-19020 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-19020?
Check the references section above for vendor advisories and patch information. Affected products include: Titanhq Webtitan.