CVE-2018-19135

ClipperCMS 1.3.3 does not have CSRF protection on its kcfinder file upload (enabled by default)

published November 11, 2018

CVSS
—
EPSS
3%
Percentile
87.1
In the wild
Unconfirmed
What it is

ClipperCMS 1.3.3 does not have CSRF protection on its kcfinder file upload (enabled by default). This can be used by an attacker to perform actions for an admin (or any user with the file upload capability). With this vulnerability, one can automatically upload files (by default, it allows html, pdf, xml, zip, and many other file types). A file can be accessed publicly under the "/assets/files" directory.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02962 · 87.1th percentile
Published
2018-11-11T04:00Z
EPSS history
Timeline
  • 11 NOV 04:00Z
    ClipperCMS 1.3.3 does not have CSRF protection on its kcfinder file upload (enabled by default)
    cvelistv5