CVE-2019-11447

An issue was discovered in CutePHP CuteNews 2.1.2

published April 22, 2019

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.0th percentile for exploit probability.

CVSS
—
EPSS
53%
Percentile
99.0
In the wild
Unconfirmed
What it is

An issue was discovered in CutePHP CuteNews 2.1.2. An attacker can infiltrate the server through the avatar upload process in the profile area via the avatar_file field to index.php?mod=main&opt=personal. There is no effective control of $imgsize in /core/modules/dashboard.php. The header content of a file can be changed and the control can be bypassed for code execution. (An attacker can use the GIF header for this.)

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.52553 · 99.0th percentile
Published
2019-04-22T04:01Z
EPSS history
Timeline
  • 22 SEP 03:17Z
    EPSS moved 52% → 41%
    epss
  • 06 SEP 03:12Z
    EPSS moved 52% → 41%
    epss
  • 30 AUG 16:01Z
    EPSS moved 41% → 52%
    epss
  • 29 AUG 04:45Z
    EPSS moved 52% → 41%
    epss
  • 22 APR 04:01Z
    An issue was discovered in CutePHP CuteNews 2.1.2
    cvelistv5