CVE-2019-11445

OpenKM 6.3.2 through 6.3.7 allows an attacker to upload a malicious JSP file into the /okm:root directories and move that file to the home directory of the…

published April 22, 2019

CVSS
—
EPSS
14%
Percentile
96.6
In the wild
Unconfirmed
What it is

OpenKM 6.3.2 through 6.3.7 allows an attacker to upload a malicious JSP file into the /okm:root directories and move that file to the home directory of the site, via frontend/FileUpload and admin/repository_export.jsp. This is achieved by interfering with the Filesystem path control in the admin's Export field. As a result, attackers can gain remote code execution through the application server with root privileges.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.14223 · 96.6th percentile
Published
2019-04-22T04:00Z
EPSS history
Timeline
  • 22 APR 04:00Z
    OpenKM 6.3.2 through 6.3.7 allows an attacker to upload a malicious JSP file into the /okm:root directories and move that file to the home directory of the…
    cvelistv5